slug: cyberark-identity
provider: CyberArk Identity
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 5
edges:
- tag: Authentication
  spec_file: cyberark-identity-authentication-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.92
  evidence: POST /Security/StartAuthentication  Begin an interactive authentication session; POST /Security/AdvanceAuthentication  Submit
    a mechanism response and advance the auth session
  reason: Interactive multi-mechanism authentication and session logout on an IAM/MFA platform directly
    realises Identity & Access Management.
- tag: SCIM
  spec_file: cyberark-identity-scim-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.9
  evidence: POST /scim/v2/Users  Create a SCIM user; GET /scim/v2/Groups  Query SCIM groups; schema ScimUser
  reason: SCIM user and group provisioning/deprovisioning is canonical identity lifecycle (joiners-movers-leavers)
    under Identity & Access Management.
- tag: UserMgmt
  spec_file: cyberark-identity-usermgmt-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.9
  evidence: POST /UserMgmt/SetCloudLock  Lock or unlock a cloud user account; POST /UserMgmt/RemoveUsers  Delete
    cloud users; POST /UserMgmt/InviteUsers
  reason: Account invitation, attribute change, lock/unlock and deletion of users are identity lifecycle
    operations on an IAM platform, realising Identity & Access Management rather than HR records.
- tag: CDirectoryService
  spec_file: cyberark-identity-cdirectoryservice-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.85
  evidence: POST /CDirectoryService/CreateUser  Create a cloud directory user; POST /CDirectoryService/ChangeUser  Update
    a cloud user profile
  reason: Directory user lifecycle CRUD on an identity platform — identity administration, i.e. Identity
    & Access Management.
- tag: OAuth
  spec_file: cyberark-identity-oauth-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.75
  evidence: POST /OAuth2/Token/{appId}  Issue an OAuth 2.0 token for a registered OAuth app; schema OAuthToken
  reason: Token issuance for registered OAuth clients on an IAM platform is federation/credential issuance
    under Identity & Access Management; could alternatively read as developer credential management, hence
    moderate confidence.