generated: '2026-07-18' method: generated source: openapi/codesphere-openapi-original.json description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 80 by_action_class: connected: 30 acting: 50 by_consequence: read: 30 write: 47 physical: 2 safety-critical: 1 human_in_the_loop_required: 1 operations: - path: /clusters/organizations method: get operationId: clusters-listAllOrganizations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /clusters/organizations method: post operationId: clusters-createOrganization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /clusters/admins method: post operationId: clusters-addClusterAdmin x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /domains/team/{teamId}/domain/{domainName} method: get operationId: domains-getDomain x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /domains/team/{teamId}/domain/{domainName} method: post operationId: domains-createDomain x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /domains/team/{teamId}/domain/{domainName} method: patch operationId: domains-updateDomain x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /domains/team/{teamId}/domain/{domainName} method: delete operationId: domains-deleteDomain x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /domains/team/{teamId} method: get operationId: domains-listDomains x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /domains/team/{teamId}/domain/{domainName}/verify method: post operationId: domains-verifyDomain x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /domains/team/{teamId}/domain/{domainName}/workspace-connections method: put operationId: domains-updateWorkspaceConnections x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /managed-services/providers method: get operationId: managed-services-listProviders x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /managed-services/providers method: post operationId: managed-services-createProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /managed-services/providers method: put operationId: managed-services-upsertProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /managed-services/providers/{name}/{schemaVersion} method: delete operationId: managed-services-deleteProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /managed-services/providers/{name}/{schemaVersion} method: patch operationId: managed-services-updateProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /managed-services method: post operationId: managed-services-create x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /managed-services method: get operationId: managed-services-list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /managed-services/{id} method: delete operationId: managed-services-delete x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /managed-services/{id} method: get operationId: managed-services-getDetails x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /managed-services/{id} method: patch operationId: managed-services-update x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /managed-services/{id}/backups method: post operationId: managed-services-scheduleBackup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/datacenters method: get operationId: metadata-getDatacenters x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/workspace-plans method: get operationId: metadata-getWorkspacePlans x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/workspace-base-images method: get operationId: metadata-getWorkspaceBaseImages x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{organizationId}/members method: post operationId: organizations-addOrgMember x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /organizations/{organizationId}/members method: get operationId: organizations-listOrgMembers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{organizationId}/members/{userId}/role method: put operationId: organizations-changeOrgRole x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /organizations method: get operationId: organizations-listOrganizations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{organizationId}/teams method: get operationId: organizations-listOrgTeams x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{organizationId}/members/{userId} method: delete operationId: organizations-removeOrgMember x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /ssh/keys method: post operationId: ssh-uploadPublicKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /ssh/keys method: get operationId: ssh-listPublicKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /ssh/keys method: delete operationId: ssh-deletePublicKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /teams/{teamId} method: get operationId: teams-getTeam x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /teams/{teamId} method: delete operationId: teams-deleteTeam x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /teams method: get operationId: teams-listTeams x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /teams method: post operationId: teams-createTeam x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /teams/{teamId}/migrate method: post operationId: teams-migrateTeamToOrg x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /teams/{teamId}/members method: post operationId: teams-inviteMember x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /teams/{teamId}/members method: get operationId: teams-listMembers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /teams/{teamId}/members/{userId}/role method: put operationId: teams-changeRole x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /teams/{teamId}/members/{userId} method: delete operationId: teams-removeMember x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /vault/teams/{teamId}/shared method: get operationId: vault-listSharedVaults x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /vault/teams/{teamId}/shared method: post operationId: vault-createSharedVault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /vault/teams/{teamId}/shared/{vaultName} method: delete operationId: vault-deleteSharedVault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /vault/teams/{teamId}/shared/{vaultName}/secrets method: post operationId: vault-storeSharedSecrets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /vault/teams/{teamId}/shared/{vaultName}/secrets method: delete operationId: vault-deleteSharedSecrets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /vault/teams/{teamId}/shared/{vaultName}/generate method: post operationId: vault-generateSharedSecrets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /vault/teams/{teamId}/shared/{vaultName}/keys method: get operationId: vault-listSharedSecretKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /vault/teams/{teamId}/workspaces/{workspaceId} method: post operationId: vault-storeWorkspaceSecrets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /vault/teams/{teamId}/workspaces/{workspaceId} method: delete operationId: vault-deleteWorkspaceSecrets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /vault/teams/{teamId}/workspaces/{workspaceId}/keys method: get operationId: vault-listWorkspaceSecrets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /vault/teams/{teamId}/workspaces/{workspaceId}/generate method: post operationId: vault-generateSecrets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId} method: get operationId: workspaces-getWorkspace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workspaces/{workspaceId} method: patch operationId: workspaces-updateWorkspace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId} method: delete operationId: workspaces-deleteWorkspace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/status method: get operationId: workspaces-getWorkspaceStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workspaces method: post operationId: workspaces-createWorkspace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/team/{teamId} method: get operationId: workspaces-listWorkspaces x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workspaces/{workspaceId}/landscape/deploy/{profile} method: post operationId: workspaces-deployLandscape-1 x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/landscape/deploy method: post operationId: workspaces-deployLandscape x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/landscape/teardown method: delete operationId: workspaces-teardownLandscape x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/landscape/scale method: patch operationId: workspaces-scaleLandscapeServices x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/pipeline/{stage}/start/{profile} method: post operationId: workspaces-startPipelineStage-1 x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/pipeline/{stage}/start method: post operationId: workspaces-startPipelineStage x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/pipeline/{stage}/stop method: post operationId: workspaces-stopPipelineStage x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /workspaces/{workspaceId}/pipeline/{stage} method: get operationId: workspaces-pipelineStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workspaces/{workspaceId}/env-vars method: get operationId: workspaces-listEnvVars x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workspaces/{workspaceId}/env-vars method: put operationId: workspaces-setEnvVar x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/env-vars method: delete operationId: workspaces-deleteEnvVar x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/execute method: post operationId: workspaces-executeCommand x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/git/head method: get operationId: workspaces-gitHead x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workspaces/{workspaceId}/git/pull/{remote}/{branch} method: post operationId: workspaces-gitPull-2 x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/git/pull/{remote} method: post operationId: workspaces-gitPull-1 x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/git/pull method: post operationId: workspaces-gitPull x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /workspaces/{workspaceId}/logs/{stage}/{step} method: get operationId: workspaces-logs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workspaces/{workspaceId}/logs/run/{step}/server/{server} method: get operationId: workspaces-serverLogs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workspaces/{workspaceId}/logs/run/{step}/replica/{replica} method: get operationId: workspaces-replicaLogs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /usage/teams/{teamId}/resources/landscape-service/summary method: get operationId: usage-getUsageSummaryLandscape x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /usage/teams/{teamId}/resources/landscape-service/{resourceId}/events method: get operationId: usage-getLandscapeServiceEvents x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none