generated: '2026-07-15' method: generated source: openapi/coder-rest-api-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 378 by_action_class: connected: 213 acting: 165 by_consequence: read: 213 write: 150 physical: 7 safety-critical: 8 human_in_the_loop_required: 8 operations: - path: /.well-known/oauth-authorization-server method: get operationId: oauth2-authorization-server-metadata x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /.well-known/oauth-protected-resource method: get operationId: oauth2-protected-resource-metadata x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats method: get operationId: list-chats x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats method: post operationId: create-chat x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/experimental/chats/config/retention-days method: get operationId: get-chat-retention-days x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/config/retention-days method: put operationId: update-chat-retention-days x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/experimental/chats/files method: post operationId: upload-chat-file x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/experimental/chats/files/{file} method: get operationId: get-chat-file x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/insights/pull-requests method: get operationId: get-pr-insights x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/models method: get operationId: list-chat-models x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/watch method: get operationId: watch-chat-events-for-a-user-via-websockets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/{chat} method: get operationId: get-chat-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/{chat} method: patch operationId: update-chat x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/experimental/chats/{chat}/acl method: get operationId: get-chat-acls x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/{chat}/acl method: patch operationId: update-chat-acl x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/experimental/chats/{chat}/diff method: get operationId: get-chat-diff-contents x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/{chat}/interrupt method: post operationId: interrupt-chat x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/experimental/chats/{chat}/messages method: get operationId: list-chat-messages x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/{chat}/messages method: post operationId: send-chat-message x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/experimental/chats/{chat}/messages/{message} method: patch operationId: edit-chat-message x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/experimental/chats/{chat}/prompts method: get operationId: list-chat-user-prompts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/{chat}/reconcile-invalid method: post operationId: reconcile-invalid-chat-state x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/experimental/chats/{chat}/stream method: get operationId: stream-chat-events-via-websockets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/{chat}/stream/desktop method: get operationId: connect-to-chat-workspace-desktop-via-websockets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/{chat}/stream/git method: get operationId: watch-chat-workspace-git-state-via-websockets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/{chat}/stream/parts method: get operationId: stream-chat-parts-via-websockets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/chats/{chat}/title/regenerate method: post operationId: regenerate-chat-title x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/experimental/users/{user}/skills method: get operationId: list-user-skills x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/users/{user}/skills method: post operationId: create-a-user-skill x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/experimental/users/{user}/skills/{skillName} method: get operationId: get-a-user-skill-by-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/experimental/users/{user}/skills/{skillName} method: delete operationId: delete-a-user-skill x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/experimental/users/{user}/skills/{skillName} method: patch operationId: update-a-user-skill x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/experimental/watch-all-workspacebuilds method: get operationId: watch-all-workspace-builds x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/ method: get operationId: api-root-handler x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/ai/providers method: get operationId: list-ai-providers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/ai/providers method: post operationId: create-an-ai-provider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/ai/providers/{idOrName} method: get operationId: get-an-ai-provider x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/ai/providers/{idOrName} method: delete operationId: delete-an-ai-provider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/ai/providers/{idOrName} method: patch operationId: update-an-ai-provider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/aibridge/clients method: get operationId: list-ai-bridge-clients x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/aibridge/keys method: get operationId: list-ai-gateway-keys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/aibridge/keys method: post operationId: create-ai-gateway-key x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/aibridge/keys/{key} method: delete operationId: delete-ai-gateway-key x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/aibridge/models method: get operationId: list-ai-bridge-models x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/aibridge/sessions method: get operationId: list-ai-bridge-sessions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/aibridge/sessions/{session_id} method: get operationId: get-ai-bridge-session-threads x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/appearance method: get operationId: get-appearance x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/appearance method: put operationId: update-appearance x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/applications/auth-redirect method: get operationId: redirect-to-uri-with-encrypted-api-key x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/applications/host method: get operationId: get-applications-host x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/applications/reconnecting-pty-signed-token method: post operationId: issue-signed-app-token-for-reconnecting-pty x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/audit method: get operationId: get-audit-logs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/audit/testgenerate method: post operationId: generate-fake-audit-log x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/auth/scopes method: get operationId: list-api-key-scopes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/authcheck method: post operationId: check-authorization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/buildinfo method: get operationId: build-info x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/connectionlog method: get operationId: get-connection-logs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/csp/reports method: post operationId: report-csp-violations x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/debug/coordinator method: get operationId: debug-info-wireguard-coordinator x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/derp/traffic method: get operationId: debug-derp-traffic x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/expvar method: get operationId: debug-expvar x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/health method: get operationId: debug-info-deployment-health x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/health/settings method: get operationId: get-health-settings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/health/settings method: put operationId: update-health-settings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/debug/metrics method: get operationId: debug-metrics x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/pprof method: get operationId: debug-pprof-index x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/pprof/cmdline method: get operationId: debug-pprof-cmdline x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/pprof/profile method: get operationId: debug-pprof-profile x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/pprof/symbol method: get operationId: debug-pprof-symbol x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/pprof/trace method: get operationId: debug-pprof-trace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/profile method: post operationId: collect-debug-profiles x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/debug/tailnet method: get operationId: debug-info-tailnet x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/ws method: get operationId: debug-info-websocket-test x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/debug/{user}/debug-link method: get operationId: debug-oidc-context-for-a-user x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/deployment/config method: get operationId: get-deployment-config x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/deployment/ssh method: get operationId: ssh-config x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/deployment/stats method: get operationId: get-deployment-stats x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/derp-map method: get operationId: get-derp-map-updates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/entitlements method: get operationId: get-entitlements x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/experiments method: get operationId: get-enabled-experiments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/experiments/available method: get operationId: get-safe-experiments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/external-auth method: get operationId: get-user-external-auths x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/external-auth/{externalauth} method: get operationId: get-external-auth-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/external-auth/{externalauth} method: delete operationId: delete-external-auth-user-link-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/external-auth/{externalauth}/device method: get operationId: get-external-auth-device-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/external-auth/{externalauth}/device method: post operationId: post-external-auth-device-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/files method: post operationId: upload-file x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/files/{fileID} method: get operationId: get-file-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/groups method: get operationId: get-groups x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/groups/{group} method: get operationId: get-group-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/groups/{group} method: delete operationId: delete-group-by-name x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/groups/{group} method: patch operationId: update-group-by-name x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/groups/{group}/ai/budget method: get operationId: get-group-ai-budget x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/groups/{group}/ai/budget method: put operationId: upsert-group-ai-budget x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/groups/{group}/ai/budget method: delete operationId: delete-group-ai-budget x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/groups/{group}/members method: get operationId: get-group-members-by-group-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/init-script/{os}/{arch} method: get operationId: get-agent-init-script x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/insights/daus method: get operationId: get-deployment-daus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/insights/templates method: get operationId: get-insights-about-templates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/insights/user-activity method: get operationId: get-insights-about-user-activity x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/insights/user-latency method: get operationId: get-insights-about-user-latency x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/insights/user-status-counts method: get operationId: get-insights-about-user-status-counts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/licenses method: get operationId: get-licenses x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/licenses method: post operationId: add-new-license x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/licenses/refresh-entitlements method: post operationId: update-license-entitlements x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/licenses/{id} method: delete operationId: delete-license x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/notifications/custom method: post operationId: send-a-custom-notification x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/notifications/dispatch-methods method: get operationId: get-notification-dispatch-methods x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/notifications/inbox method: get operationId: list-inbox-notifications x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/notifications/inbox/mark-all-as-read method: put operationId: mark-all-unread-notifications-as-read x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/notifications/inbox/watch method: get operationId: watch-for-new-inbox-notifications x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/notifications/inbox/{id}/read-status method: put operationId: update-read-status-of-a-notification x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/notifications/settings method: get operationId: get-notifications-settings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/notifications/settings method: put operationId: update-notifications-settings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/notifications/templates/custom method: get operationId: get-custom-notification-templates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/notifications/templates/system method: get operationId: get-system-notification-templates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/notifications/templates/{notification_template}/method method: put operationId: update-notification-template-dispatch-method x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/notifications/test method: post operationId: send-a-test-notification x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/oauth2-provider/apps method: get operationId: get-oauth2-applications x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/oauth2-provider/apps method: post operationId: create-oauth2-application x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/oauth2-provider/apps/{app} method: get operationId: get-oauth2-application x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/oauth2-provider/apps/{app} method: put operationId: update-oauth2-application x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/oauth2-provider/apps/{app} method: delete operationId: delete-oauth2-application x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/oauth2-provider/apps/{app}/secrets method: get operationId: get-oauth2-application-secrets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/oauth2-provider/apps/{app}/secrets method: post operationId: create-oauth2-application-secret x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/oauth2-provider/apps/{app}/secrets/{secretID} method: delete operationId: delete-oauth2-application-secret x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations method: get operationId: get-organizations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations method: post operationId: create-organization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization} method: get operationId: get-organization-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization} method: delete operationId: delete-organization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization} method: patch operationId: update-organization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/groups method: get operationId: get-groups-by-organization x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/groups method: post operationId: create-group-for-organization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/groups/{groupName} method: get operationId: get-group-by-organization-and-group-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/groups/{groupName}/members method: get operationId: get-group-members-by-organization-and-group-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/members method: get operationId: list-organization-members x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/members/roles method: get operationId: get-member-roles-by-organization x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/members/roles method: put operationId: update-a-custom-organization-role x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/members/roles method: post operationId: insert-a-custom-organization-role x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/members/roles/{roleName} method: delete operationId: delete-a-custom-organization-role x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/members/{user} method: get operationId: get-organization-member x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/members/{user} method: post operationId: add-organization-member x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/members/{user} method: delete operationId: remove-organization-member x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/members/{user}/roles method: put operationId: assign-role-to-organization-member x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/members/{user}/workspace-quota method: get operationId: get-workspace-quota-by-user x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/members/{user}/workspaces method: post operationId: create-user-workspace-by-organization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/members/{user}/workspaces/available-users method: get operationId: get-users-available-for-workspace-creation x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/paginated-members method: get operationId: paginated-organization-members x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/provisionerdaemons method: get operationId: get-provisioner-daemons x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/provisionerdaemons/serve method: get operationId: serve-provisioner-daemon x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/provisionerjobs method: get operationId: get-provisioner-jobs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/provisionerjobs/{job} method: get operationId: get-provisioner-job x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/provisionerkeys method: get operationId: list-provisioner-key x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/provisionerkeys method: post operationId: create-provisioner-key x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/provisionerkeys/daemons method: get operationId: list-provisioner-key-daemons x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/provisionerkeys/{provisionerkey} method: delete operationId: delete-provisioner-key x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/settings/idpsync/available-fields method: get operationId: get-the-available-organization-idp-sync-claim-fields x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/settings/idpsync/field-values method: get operationId: get-the-organization-idp-sync-claim-field-values x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/settings/idpsync/groups method: get operationId: get-group-idp-sync-settings-by-organization x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/settings/idpsync/groups method: patch operationId: update-group-idp-sync-settings-by-organization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/settings/idpsync/groups/config method: patch operationId: update-group-idp-sync-config x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/settings/idpsync/groups/mapping method: patch operationId: update-group-idp-sync-mapping x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/settings/idpsync/roles method: get operationId: get-role-idp-sync-settings-by-organization x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/settings/idpsync/roles method: patch operationId: update-role-idp-sync-settings-by-organization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/settings/idpsync/roles/config method: patch operationId: update-role-idp-sync-config x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/settings/idpsync/roles/mapping method: patch operationId: update-role-idp-sync-mapping x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/settings/workspace-sharing method: get operationId: get-workspace-sharing-settings-for-organization x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/settings/workspace-sharing method: patch operationId: update-workspace-sharing-settings-for-organization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/templates method: get operationId: get-templates-by-organization x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/templates method: post operationId: create-template-by-organization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/organizations/{organization}/templates/examples method: get operationId: get-template-examples-by-organization x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/templates/{templatename} method: get operationId: get-templates-by-organization-and-template-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/templates/{templatename}/versions/{templateversionname} method: get operationId: get-template-version-by-organization-template-and-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/templates/{templatename}/versions/{templateversionname}/previous method: get operationId: get-previous-template-version-by-organization-template-and-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/organizations/{organization}/templateversions method: post operationId: create-template-version-by-organization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/prebuilds/settings method: get operationId: get-prebuilds-settings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/prebuilds/settings method: put operationId: update-prebuilds-settings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/provisionerkeys/{provisionerkey} method: get operationId: fetch-provisioner-key-details x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/regions method: get operationId: get-site-wide-regions-for-workspace-connections x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/replicas method: get operationId: get-active-replicas x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/settings/idpsync/available-fields method: get operationId: get-the-available-idp-sync-claim-fields x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/settings/idpsync/field-values method: get operationId: get-the-idp-sync-claim-field-values x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/settings/idpsync/organization method: get operationId: get-organization-idp-sync-settings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/settings/idpsync/organization method: patch operationId: update-organization-idp-sync-settings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/settings/idpsync/organization/config method: patch operationId: update-organization-idp-sync-config x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/settings/idpsync/organization/mapping method: patch operationId: update-organization-idp-sync-mapping x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/tailnet method: get operationId: user-scoped-tailnet-rpc-connection x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/tasks method: get operationId: list-ai-tasks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/tasks/{user} method: post operationId: create-a-new-ai-task x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/tasks/{user}/{task} method: get operationId: get-ai-task-by-id-or-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/tasks/{user}/{task} method: delete operationId: delete-ai-task x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/tasks/{user}/{task}/input method: patch operationId: update-ai-task-input x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/tasks/{user}/{task}/logs method: get operationId: get-ai-task-logs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/tasks/{user}/{task}/pause method: post operationId: pause-task x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/tasks/{user}/{task}/resume method: post operationId: resume-task x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/tasks/{user}/{task}/send method: post operationId: send-input-to-ai-task x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templates method: get operationId: get-all-templates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templates/examples method: get operationId: get-template-examples x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templates/{template} method: get operationId: get-template-settings-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templates/{template} method: delete operationId: delete-template-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templates/{template} method: patch operationId: update-template-settings-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templates/{template}/acl method: get operationId: get-template-acls x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templates/{template}/acl method: patch operationId: update-template-acl x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templates/{template}/acl/available method: get operationId: get-template-available-acl-usersgroups x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templates/{template}/daus method: get operationId: get-template-daus-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templates/{template}/prebuilds/invalidate method: post operationId: invalidate-presets-for-template x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/templates/{template}/versions method: get operationId: list-template-versions-by-template-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templates/{template}/versions method: patch operationId: update-active-template-version-by-template-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templates/{template}/versions/archive method: post operationId: archive-template-unused-versions-by-template-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templates/{template}/versions/{templateversionname} method: get operationId: get-template-version-by-template-id-and-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion} method: get operationId: get-template-version-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion} method: patch operationId: patch-template-version-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templateversions/{templateversion}/archive method: post operationId: archive-template-version x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templateversions/{templateversion}/cancel method: patch operationId: cancel-template-version-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templateversions/{templateversion}/dry-run method: post operationId: create-template-version-dry-run x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templateversions/{templateversion}/dry-run/{jobID} method: get operationId: get-template-version-dry-run-by-job-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/dry-run/{jobID}/cancel method: patch operationId: cancel-template-version-dry-run-by-job-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templateversions/{templateversion}/dry-run/{jobID}/logs method: get operationId: get-template-version-dry-run-logs-by-job-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/dry-run/{jobID}/matched-provisioners method: get operationId: get-template-version-dry-run-matched-provisioners x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/dry-run/{jobID}/resources method: get operationId: get-template-version-dry-run-resources-by-job-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/dynamic-parameters method: get operationId: open-dynamic-parameters-websocket-by-template-version x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/dynamic-parameters/evaluate method: post operationId: evaluate-dynamic-parameters-for-template-version x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templateversions/{templateversion}/external-auth method: get operationId: get-external-auth-by-template-version x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/logs method: get operationId: get-logs-by-template-version x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/parameters method: get operationId: removed-get-parameters-by-template-version x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/presets method: get operationId: get-template-version-presets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/resources method: get operationId: get-resources-by-template-version x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/rich-parameters method: get operationId: get-rich-parameters-by-template-version x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/schema method: get operationId: removed-get-schema-by-template-version x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/templateversions/{templateversion}/unarchive method: post operationId: unarchive-template-version x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/templateversions/{templateversion}/variables method: get operationId: get-template-variables-by-template-version x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/updatecheck method: get operationId: update-check x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users method: get operationId: get-users x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users method: post operationId: create-new-user x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/authmethods method: get operationId: get-authentication-methods x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/first method: get operationId: check-initial-user-created x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/first method: post operationId: create-initial-user x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/login method: post operationId: log-in-user x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/logout method: post operationId: log-out-user x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/oauth2/github/callback method: get operationId: oauth-20-github-callback x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/oauth2/github/device method: get operationId: get-github-device-auth x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/oidc-claims method: get operationId: get-oidc-claims-for-the-authenticated-user x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/oidc/callback method: get operationId: openid-connect-callback x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/otp/change-password method: post operationId: change-password-with-a-one-time-passcode x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/otp/request method: post operationId: request-one-time-passcode x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/roles method: get operationId: get-site-member-roles x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/validate-password method: post operationId: validate-user-password x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user} method: get operationId: get-user-by-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user} method: delete operationId: delete-user x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/ai/budget method: get operationId: get-user-ai-budget-override x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/ai/budget method: put operationId: upsert-user-ai-budget-override x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/users/{user}/ai/budget method: delete operationId: delete-user-ai-budget-override x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/users/{user}/appearance method: get operationId: get-user-appearance-settings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/appearance method: put operationId: update-user-appearance-settings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/autofill-parameters method: get operationId: get-autofill-build-parameters-for-user x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/convert-login method: post operationId: convert-user-from-password-to-oauth-authentication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/gitsshkey method: get operationId: get-user-git-ssh-key x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/gitsshkey method: put operationId: regenerate-user-ssh-key x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/keys method: post operationId: create-new-session-key x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/keys/tokens method: get operationId: get-user-tokens x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/keys/tokens method: post operationId: create-token-api-key x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/keys/tokens/tokenconfig method: get operationId: get-token-config x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/keys/tokens/{keyname} method: get operationId: get-api-key-by-token-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/keys/{keyid} method: get operationId: get-api-key-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/keys/{keyid} method: delete operationId: delete-api-key x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/keys/{keyid}/expire method: put operationId: expire-api-key x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/login-type method: get operationId: get-user-login-type x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/notifications/preferences method: get operationId: get-user-notification-preferences x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/notifications/preferences method: put operationId: update-user-notification-preferences x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/organizations method: get operationId: get-organizations-by-user x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/organizations/{organizationname} method: get operationId: get-organization-by-user-and-organization-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/password method: put operationId: update-user-password x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/preferences method: get operationId: get-user-preference-settings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/preferences method: put operationId: update-user-preference-settings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/profile method: put operationId: update-user-profile x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/quiet-hours method: get operationId: get-user-quiet-hours-schedule x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/quiet-hours method: put operationId: update-user-quiet-hours-schedule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/roles method: get operationId: get-user-roles x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/roles method: put operationId: assign-role-to-user x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/secrets method: get operationId: list-user-secrets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/secrets method: post operationId: create-a-new-user-secret x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/secrets/{name} method: get operationId: get-a-user-secret-by-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/secrets/{name} method: delete operationId: delete-a-user-secret x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/secrets/{name} method: patch operationId: update-a-user-secret x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/status/activate method: put operationId: activate-user-account x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/status/suspend method: put operationId: suspend-user-account x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/webpush/subscription method: post operationId: create-user-webpush-subscription x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/webpush/subscription method: delete operationId: delete-user-webpush-subscription x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/webpush/test method: post operationId: send-a-test-push-notification x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/users/{user}/workspace/{workspacename} method: get operationId: get-workspace-metadata-by-user-and-workspace-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/workspace/{workspacename}/builds/{buildnumber} method: get operationId: get-workspace-build-by-user-workspace-name-and-build-number x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/users/{user}/workspaces method: post operationId: create-user-workspace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspace-quota/{user} method: get operationId: get-workspace-quota-by-user-deprecated x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/aws-instance-identity method: post operationId: authenticate-agent-on-aws-instance x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceagents/azure-instance-identity method: post operationId: authenticate-agent-on-azure-instance x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceagents/connection method: get operationId: get-connection-info-for-workspace-agent-generic x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/google-instance-identity method: post operationId: authenticate-agent-on-google-cloud-instance x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceagents/me/app-status method: patch operationId: patch-workspace-agent-app-status x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceagents/me/external-auth method: get operationId: get-workspace-agent-external-auth x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/me/gitauth method: get operationId: removed-get-workspace-agent-git-auth x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/me/gitsshkey method: get operationId: get-workspace-agent-git-ssh-key x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/me/log-source method: post operationId: post-workspace-agent-log-source x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceagents/me/logs method: patch operationId: patch-workspace-agent-logs x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceagents/me/reinit method: get operationId: get-workspace-agent-reinitialization x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/me/rpc method: get operationId: workspace-agent-rpc-api x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/me/tasks/{task}/log-snapshot method: post operationId: upload-task-log-snapshot x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceagents/{workspaceagent} method: get operationId: get-workspace-agent-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/{workspaceagent}/connection method: get operationId: get-connection-info-for-workspace-agent x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/{workspaceagent}/containers method: get operationId: get-running-containers-for-workspace-agent x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/{workspaceagent}/containers/devcontainers/{devcontainer} method: delete operationId: delete-devcontainer-for-workspace-agent x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceagents/{workspaceagent}/containers/devcontainers/{devcontainer}/recreate method: post operationId: recreate-devcontainer-for-workspace-agent x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceagents/{workspaceagent}/containers/watch method: get operationId: watch-workspace-agent-for-container-updates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/{workspaceagent}/coordinate method: get operationId: coordinate-workspace-agent x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/{workspaceagent}/listening-ports method: get operationId: get-listening-ports-for-workspace-agent x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/{workspaceagent}/logs method: get operationId: get-logs-by-workspace-agent x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/{workspaceagent}/pty method: get operationId: open-pty-to-workspace-agent x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/{workspaceagent}/startup-logs method: get operationId: removed-get-logs-by-workspace-agent x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/{workspaceagent}/watch-metadata method: get operationId: watch-for-workspace-agent-metadata-updates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceagents/{workspaceagent}/watch-metadata-ws method: get operationId: watch-for-workspace-agent-metadata-updates-via-websockets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspacebuilds/{workspacebuild} method: get operationId: get-workspace-build x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspacebuilds/{workspacebuild}/cancel method: patch operationId: cancel-workspace-build x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspacebuilds/{workspacebuild}/logs method: get operationId: get-workspace-build-logs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspacebuilds/{workspacebuild}/parameters method: get operationId: get-build-parameters-for-workspace-build x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspacebuilds/{workspacebuild}/resources method: get operationId: removed-get-workspace-resources-for-workspace-build x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspacebuilds/{workspacebuild}/state method: get operationId: get-provisioner-state-for-workspace-build x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspacebuilds/{workspacebuild}/state method: put operationId: update-workspace-build-state x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspacebuilds/{workspacebuild}/timings method: get operationId: get-workspace-build-timings-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceproxies method: get operationId: get-workspace-proxies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceproxies method: post operationId: create-workspace-proxy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceproxies/me/app-stats method: post operationId: report-workspace-app-stats x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceproxies/me/coordinate method: get operationId: workspace-proxy-coordinate x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceproxies/me/crypto-keys method: get operationId: get-workspace-proxy-crypto-keys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceproxies/me/deregister method: post operationId: deregister-workspace-proxy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceproxies/me/issue-signed-app-token method: post operationId: issue-signed-workspace-app-token x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceproxies/me/register method: post operationId: register-workspace-proxy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceproxies/{workspaceproxy} method: get operationId: get-workspace-proxy x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaceproxies/{workspaceproxy} method: delete operationId: delete-workspace-proxy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaceproxies/{workspaceproxy} method: patch operationId: update-workspace-proxy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces method: get operationId: list-workspaces x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaces/{workspace} method: get operationId: get-workspace-metadata-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaces/{workspace} method: patch operationId: update-workspace-metadata-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/acl method: get operationId: get-workspace-acls x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaces/{workspace}/acl method: delete operationId: completely-clears-the-workspaces-user-and-group-acls x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/acl method: patch operationId: update-workspace-acl x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/agent-connection-watch method: get operationId: workspace-agent-connection-watch x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaces/{workspace}/autostart method: put operationId: update-workspace-autostart-schedule-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/autoupdates method: put operationId: update-workspace-automatic-updates-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/builds method: get operationId: get-workspace-builds-by-workspace-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaces/{workspace}/builds method: post operationId: create-workspace-build x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/dormant method: put operationId: update-workspace-dormancy-status-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/extend method: put operationId: extend-workspace-deadline-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/external-agent/{agent}/credentials method: get operationId: get-workspace-external-agent-credentials x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaces/{workspace}/favorite method: put operationId: favorite-workspace-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/favorite method: delete operationId: unfavorite-workspace-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/port-share method: get operationId: get-workspace-agent-port-shares x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaces/{workspace}/port-share method: post operationId: upsert-workspace-agent-port-share x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/port-share method: delete operationId: delete-workspace-agent-port-share x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/resolve-autostart method: get operationId: resolve-workspace-autostart-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaces/{workspace}/timings method: get operationId: get-workspace-timings-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaces/{workspace}/ttl method: put operationId: update-workspace-ttl-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/usage method: post operationId: post-workspace-usage-by-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/workspaces/{workspace}/watch method: get operationId: watch-workspace-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/workspaces/{workspace}/watch-ws method: get operationId: watch-workspace-by-id-via-websockets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /oauth2/authorize method: get operationId: oauth2-authorization-request-get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /oauth2/authorize method: post operationId: oauth2-authorization-request-post x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /oauth2/clients/{client_id} method: get operationId: get-oauth2-client-configuration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /oauth2/clients/{client_id} method: put operationId: put-oauth2-client-configuration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /oauth2/clients/{client_id} method: delete operationId: delete-oauth2-client-configuration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /oauth2/register method: post operationId: oauth2-dynamic-client-registration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /oauth2/revoke method: post operationId: oauth2-token-revocation x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /oauth2/tokens method: post operationId: oauth2-token-exchange x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /oauth2/tokens method: delete operationId: delete-oauth2-application-tokens x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /scim/v2/ServiceProviderConfig method: get operationId: scim-get-service-provider-config x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scim/v2/Users method: get operationId: scim-get-users x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scim/v2/Users method: post operationId: scim-create-new-user x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /scim/v2/Users/{id} method: get operationId: scim-get-user-by-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scim/v2/Users/{id} method: put operationId: scim-replace-user-status x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /scim/v2/Users/{id} method: patch operationId: scim-update-user-status x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required