generated: '2026-07-15' method: generated source: openapi/cortex-idp-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 47 by_action_class: connected: 22 acting: 25 by_consequence: read: 22 write: 21 physical: 4 human_in_the_loop_required: 0 operations: - path: /catalog method: get operationId: listCatalogEntities x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /catalog method: delete operationId: deleteCatalogEntitiesByType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/descriptors method: get operationId: listEntityDescriptors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /catalog/{tagOrId} method: get operationId: getCatalogEntity x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /catalog/{tagOrId} method: delete operationId: deleteCatalogEntity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/openapi method: get operationId: getEntityDescriptor x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /catalog/{tagOrId}/archive method: put operationId: archiveEntity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/unarchive method: put operationId: unarchiveEntity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/gitops-logs method: get operationId: getGitopsLogs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /open-api method: post operationId: upsertEntity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /open-api method: patch operationId: patchEntity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/scorecards method: get operationId: getEntityScorecardScores x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scorecards method: get operationId: listScorecards x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scorecards/descriptor method: post operationId: upsertScorecardDescriptor x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /scorecards/{tag} method: get operationId: getScorecard x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scorecards/{tag} method: delete operationId: deleteScorecard x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /scorecards/{tag}/descriptor method: get operationId: getScorecardDescriptor x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scorecards/{tag}/scores method: get operationId: getScorecardScores x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scorecards/{tag}/next-steps method: get operationId: getScorecardNextSteps x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scorecards/{scorecardTag}/entity/{tagOrId}/badge method: get operationId: getScorecardBadge x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scorecards/{tag}/entity/{entityTag}/scores method: post operationId: submitScorecardScore x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /scorecards/{tag}/entity/{entityTag}/exemption method: post operationId: requestExemption x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /custom-data method: get operationId: getCustomDataAdvanced x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /custom-data method: put operationId: bulkUpsertCustomData x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/custom-data method: get operationId: listEntityCustomData x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /catalog/{tagOrId}/custom-data method: post operationId: addEntityCustomData x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/custom-data method: delete operationId: deleteEntityCustomData x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/custom-data/{key} method: get operationId: getEntityCustomDataByKey x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /initiatives method: get operationId: listInitiatives x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /initiatives method: post operationId: createInitiative x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /initiatives/{cid} method: get operationId: getInitiative x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /initiatives/{cid} method: put operationId: updateInitiative x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /initiatives/{cid} method: delete operationId: deleteInitiative x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/deploys method: get operationId: listEntityDeploys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /catalog/{tagOrId}/deploys method: post operationId: addEntityDeploy x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/deploys method: delete operationId: deleteEntityDeploys x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/deploys/{uuid} method: put operationId: updateEntityDeploy x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /catalog/{tagOrId}/deploys/{uuid} method: delete operationId: deleteEntityDeploy x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /deploys/environments method: get operationId: listDeployEnvironments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /deploys/search method: get operationId: searchDeploys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /github/configurations method: get operationId: listGithubConfigurations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /github/configurations method: delete operationId: deleteGithubConfigurations x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /github/default-configuration method: get operationId: getGithubDefaultConfiguration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /github/configurations/validate method: post operationId: validateGithubConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /github/configurations/app method: post operationId: addGithubAppConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /github/configurations/app/{alias} method: put operationId: updateGithubAppConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /github/configurations/app/{alias} method: delete operationId: deleteGithubAppConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required