slug: engineering-platform provider: APIs.io Engineering Platform generated_by: planning/capability-mapping/scripts/classify_capabilities.py model: claude-opus-5 frame: - Software & Technology min_confidence: 0.7 capability_model: source: https://github.com/vincentmakes/turbo-ea-capabilities license: CC-BY-4.0 attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 notice: NOTICE edge_count: 207 edges: - tag: '#Action=AttachUserPolicy' spec_file: engineering-platform-action-attachuserpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'POST_AttachUserPolicy; schemas: AttachUserPolicyRequest, userNameType, PolicyNotAttachableException' reason: AWS IAM operation attaching a permissions policy to a user — identity and access management, not enterprise policy lifecycle. - tag: '#Action=CreateOpenIDConnectProvider' spec_file: engineering-platform-action-createopenidconnectprovider-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: CreateOpenIDConnectProviderRequest, OpenIDConnectProviderUrlType, thumbprintListType, clientIDListType reason: Registers an OIDC identity provider for federated authentication — identity federation within IAM. - tag: '#Action=CreateRole' spec_file: engineering-platform-action-createrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: CreateRoleRequest, roleNameType, policyDocumentType, PermissionsBoundaryAttachmentType reason: Creates an IAM role with an assume-role policy document — role-based access management. - tag: '#Action=CreateSAMLProvider' spec_file: engineering-platform-action-createsamlprovider-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: CreateSAMLProviderRequest, SAMLProviderNameType, SAMLMetadataDocumentType reason: Registers a SAML identity provider for federated sign-in — identity federation within IAM. - tag: '#Action=DeleteUser' spec_file: engineering-platform-action-deleteuser-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'POST_DeleteUser; schemas: existingUserNameType, DeleteUserRequest, NoSuchEntityException — AWS IAM user deletion' reason: Operations delete an IAM identity (user) on AWS; this is identity and access administration, not HR employee records. Cybersecurity Management / Identity & Access Management is the honest fit for this infrastructure API. - tag: '#Action=DeleteUserPermissionsBoundary' spec_file: engineering-platform-action-deleteuserpermissionsboundary-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: GET_DeleteUserPermissionsBoundary; schema DeleteUserPermissionsBoundaryRequest, userNameType reason: Removing a permissions boundary from an IAM user is directly access-permission administration. - tag: '#Action=DeleteUserPolicy' spec_file: engineering-platform-action-deleteuserpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'schemas: existingUserNameType, policyNameType, DeleteUserPolicyRequest' reason: Deleting an inline access policy attached to an IAM user is entitlement/permission management within IAM, not enterprise Policy Management. - tag: '#Action=DeleteVirtualMFADevice' spec_file: engineering-platform-action-deletevirtualmfadevice-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: POST_DeleteVirtualMFADevice; schema serialNumberType, DeleteVirtualMFADeviceRequest reason: Managing multi-factor authentication devices is authentication credential administration under Identity & Access Management. - tag: '#Action=DetachGroupPolicy' spec_file: engineering-platform-action-detachgrouppolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'schemas: groupNameType, DetachGroupPolicyRequest, arnType' reason: Detaching a managed permission policy from an IAM group is access rights administration. - tag: '#Action=DetachRolePolicy' spec_file: engineering-platform-action-detachrolepolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'schemas: roleNameType, DetachRolePolicyRequest, UnmodifiableEntityException' reason: Detaching permission policies from an IAM role is role-based access control administration. - tag: '#Action=DetachUserPolicy' spec_file: engineering-platform-action-detachuserpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'schemas: userNameType, DetachUserPolicyRequest, arnType' reason: Detaching a permission policy from an IAM user directly performs access entitlement management. - tag: '#Action=EnableMFADevice' spec_file: engineering-platform-action-enablemfadevice-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'schemas: authenticationCodeType, serialNumberType, EnableMFADeviceRequest, InvalidAuthenticationCodeException' reason: Enabling an MFA device for a user is strong-authentication credential provisioning, squarely Identity & Access Management. - tag: '#Action=GetAccountAuthorizationDetails' spec_file: engineering-platform-action-getaccountauthorizationdetails-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'GET_GetAccountAuthorizationDetails; schemas: userDetailListType, roleDetailListType, ManagedPolicyDetail, AttachedPolicy, AttachedPermissionsBoundary' reason: AWS IAM operation retrieving users, groups, roles and attached policy documents — identity and access management, not a business-domain capability. - tag: '#Action=GetRole' spec_file: engineering-platform-action-getrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'GET_GetRole; schemas: roleNameType, RoleLastUsed, AttachedPermissionsBoundary, policyDocumentType' reason: IAM role retrieval with permissions boundaries and assume-role policy documents is plainly access-permission administration (IAM). - tag: '#Action=GetRolePolicy' spec_file: engineering-platform-action-getrolepolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: GetRolePolicyRequest, roleNameType, policyNameType, policyDocumentType reason: Retrieves the inline permission policy attached to an IAM role — access control administration. - tag: '#Action=GetSAMLProvider' spec_file: engineering-platform-action-getsamlprovider-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: GetSAMLProviderRequest, SAMLMetadataDocumentType reason: SAML identity-provider metadata retrieval is identity federation, squarely within Identity & Access Management. - tag: '#Action=GetUserPolicy' spec_file: engineering-platform-action-getuserpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: GetUserPolicyRequest, existingUserNameType, policyNameType, policyDocumentType reason: Retrieves the inline permission policy attached to an IAM user — access-rights administration (IAM), not corporate Policy Management. - tag: '#Action=ListPoliciesGrantingServiceAccess' spec_file: engineering-platform-action-listpoliciesgrantingserviceaccess-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: PolicyGrantingServiceAccess; listPolicyGrantingServiceAccessResponseListType; serviceNamespaceListType reason: Explicitly reports which IAM policies grant access to a service namespace for an entity — access-decision analysis, unambiguously Identity & Access Management. - tag: '#Action=ListUserPolicies' spec_file: engineering-platform-action-listuserpolicies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: ListUserPoliciesRequest, policyNameListType, existingUserNameType reason: Lists inline permission policies attached to an IAM user — access policy administration, core Identity & Access Management. - tag: '#Action=ListVirtualMFADevices' spec_file: engineering-platform-action-listvirtualmfadevices-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: ListVirtualMFADevicesResponse, VirtualMFADevice, assignmentStatusType, serialNumberType reason: Enumerates virtual MFA devices and their assignment to users — multi-factor authentication administration within IAM. - tag: '#Action=PutGroupPolicy' spec_file: engineering-platform-action-putgrouppolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: PutGroupPolicyRequest, policyDocumentType, groupNameType, MalformedPolicyDocumentException reason: Attaches an inline permission policy document to an IAM group — authorisation policy administration, Identity & Access Management (not corporate Policy Management). - tag: '#Action=PutRolePermissionsBoundary' spec_file: engineering-platform-action-putrolepermissionsboundary-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: PutRolePermissionsBoundaryRequest, roleNameType, PolicyNotAttachableException reason: Sets the permissions boundary on an IAM role — privilege scoping and access control administration. - tag: '#Action=PutRolePolicy' spec_file: engineering-platform-action-putrolepolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'POST_PutRolePolicy; schemas: roleNameType, policyDocumentType, PutRolePolicyRequest' reason: AWS IAM operation attaching an inline permissions policy to a role — identity and access management, not enterprise policy management. - tag: '#Action=PutUserPermissionsBoundary' spec_file: engineering-platform-action-putuserpermissionsboundary-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: 'POST_PutUserPermissionsBoundary; schemas: userNameType, PolicyNotAttachableException, arnType' reason: IAM user permissions boundary management is access management for cloud identities. - tag: '#Action=PutUserPolicy' spec_file: engineering-platform-action-putuserpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: PutUserPolicyRequest, existingUserNameType, policyDocumentType reason: Attaching an inline IAM policy to a user — identity and access management. - tag: '#Action=RemoveUserFromGroup' spec_file: engineering-platform-action-removeuserfromgroup-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: RemoveUserFromGroupRequest, existingUserNameType, groupNameType reason: Removing a user from an access group is classic identity and access administration. - tag: '#Action=ResyncMFADevice' spec_file: engineering-platform-action-resyncmfadevice-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: ResyncMFADeviceRequest, InvalidAuthenticationCodeException, serialNumberType reason: MFA device synchronisation for a user is authentication/identity and access management. - tag: Access Identity Providers spec_file: engineering-platform-access-identity-providers-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.9 evidence: POST /accounts/{account_id}/access/identity_providers — "Add an Access identity provider"; schemas access_saml, access_oidc, access_okta, access_google-apps reason: Configuration of SAML/OIDC/Okta/Google identity providers for federated authentication — unambiguously identity federation within Identity & Access Management. - tag: '#Action=AddUserToGroup' spec_file: engineering-platform-action-addusertogroup-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: AddUserToGroupRequest; existingUserNameType; groupNameType reason: AWS IAM user-to-group membership assignment is textbook access administration under Identity & Access Management. - tag: '#Action=AttachGroupPolicy' spec_file: engineering-platform-action-attachgrouppolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: AttachGroupPolicyRequest; groupNameType; PolicyNotAttachableException reason: Attaching an IAM permission policy to a group is authorisation/entitlement administration, i.e. Identity & Access Management. - tag: '#Action=AttachRolePolicy' spec_file: engineering-platform-action-attachrolepolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: AttachRolePolicyRequest; roleNameType; PolicyNotAttachableException reason: Attaching an IAM policy to a role grants access rights — Identity & Access Management, not the API-gateway product implied by the concatenated title. - tag: '#Action=ChangePassword' spec_file: engineering-platform-action-changepassword-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: ChangePasswordRequest, passwordType, PasswordPolicyViolationException reason: Credential/password change for an IAM user — identity and access management. - tag: '#Action=CreateAccessKey' spec_file: engineering-platform-action-createaccesskey-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: CreateAccessKeyResponse, accessKeySecretType, accessKeyIdType, existingUserNameType reason: Issues access-key credentials for an IAM user — credential issuance under identity and access management. - tag: '#Action=CreateLoginProfile' spec_file: engineering-platform-action-createloginprofile-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: CreateLoginProfileRequest, LoginProfile, passwordType, PasswordPolicyViolationException reason: Creates console sign-in credentials for an IAM user — identity and access management. - tag: '#Action=CreateUser' spec_file: engineering-platform-action-createuser-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: 'POST_CreateUser; schemas: CreateUserRequest, userNameType, User, PermissionsBoundaryAttachmentType' reason: Creates an IAM user with permissions boundary — account provisioning for platform access, not an HR employee record. Maps to Identity & Access Management. - tag: '#Action=CreateVirtualMFADevice' spec_file: engineering-platform-action-createvirtualmfadevice-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: 'schemas: CreateVirtualMFADeviceRequest, VirtualMFADevice, virtualMFADeviceName, serialNumberType' reason: Provisioning a virtual MFA device for a user is authentication factor management, a core Identity & Access Management activity. - tag: '#Action=DeactivateMFADevice' spec_file: engineering-platform-action-deactivatemfadevice-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: 'POST_DeactivateMFADevice; schemas: DeactivateMFADeviceRequest, existingUserNameType, serialNumberType' reason: Deactivating a user's MFA device is authentication factor administration within Identity & Access Management. - tag: '#Action=DeleteGroupPolicy' spec_file: engineering-platform-action-deletegrouppolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: 'schemas: DeleteGroupPolicyRequest, policyNameType, groupNameType' reason: Deletes an inline access policy attached to an IAM group — authorisation policy administration under Identity & Access Management (not corporate Policy Management). - tag: '#Action=GetAccountPasswordPolicy' spec_file: engineering-platform-action-getaccountpasswordpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: 'GET_GetAccountPasswordPolicy; schemas: PasswordPolicy, minimumPasswordLengthType, passwordReusePreventionType, maxPasswordAgeType' reason: Retrieves the account's password policy (length, reuse, expiry) — an IAM credential-policy control under Identity & Access Management. - tag: '#Action=GetGroup' spec_file: engineering-platform-action-getgroup-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: 'GET_GetGroup; schemas: Group, userListType, User, PermissionsBoundaryAttachmentType' reason: Retrieves an IAM group and its member users with permissions boundary — access group administration, i.e. IAM. - tag: '#Action=GetGroupPolicy' spec_file: engineering-platform-action-getgrouppolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: 'GET_GetGroupPolicy; schemas: GetGroupPolicyResponse, groupNameType, policyDocumentType' reason: Retrieves an inline permission policy document attached to an IAM group — access policy management. - tag: '#Action=ListAttachedGroupPolicies' spec_file: engineering-platform-action-listattachedgrouppolicies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: ListAttachedGroupPoliciesRequest, AttachedPolicy, groupNameType, policyPathType reason: Lists IAM permission policies attached to a group — access permission administration, i.e. Identity & Access Management, not corporate Policy Management. - tag: '#Action=ListAttachedRolePolicies' spec_file: engineering-platform-action-listattachedrolepolicies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: ListAttachedRolePoliciesRequest, AttachedPolicy, roleNameType reason: Lists IAM permission policies attached to a role — role-based access permission administration. - tag: '#Action=ListAttachedUserPolicies' spec_file: engineering-platform-action-listattacheduserpolicies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: ListAttachedUserPoliciesRequest, AttachedPolicy, userNameType reason: Lists IAM permission policies attached to a user — user access rights administration. - tag: '#Action=ListMFADevices' spec_file: engineering-platform-action-listmfadevices-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: GET_ListMFADevices; schemas mfaDeviceListType, MFADevice, userNameType, existingUserNameType reason: Lists MFA devices registered to an IAM user — multi-factor authentication credential enumeration, squarely Identity & Access Management, not any business-domain capability. - tag: '#Action=ListOpenIDConnectProviders' spec_file: engineering-platform-action-listopenidconnectproviders-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: GET_ListOpenIDConnectProviders; schemas OpenIDConnectProviderListEntry, OpenIDConnectProviderListType reason: Enumerates OIDC identity providers configured in IAM — identity federation configuration, a core Identity & Access Management concern. - tag: '#Action=ListRolePolicies' spec_file: engineering-platform-action-listrolepolicies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: ListRolePoliciesRequest; schemas roleNameType, policyNameListType reason: Lists inline access policies attached to an IAM role — role-based access control administration, i.e. Identity & Access Management. - tag: '#Action=ListRoles' spec_file: engineering-platform-action-listroles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: schemas roleListType, roleNameType, policyDocumentType, AttachedPermissionsBoundary, PermissionsBoundaryAttachmentType, RoleLastUsed reason: Enumerates IAM roles with their trust policy documents and permissions boundaries — access-control role administration, clearly Identity & Access Management rather than HR roles. - tag: '#Action=ListSAMLProviders' spec_file: engineering-platform-action-listsamlproviders-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: 'GET_ListSAMLProviders; schemas: SAMLProviderListEntry, ListSAMLProvidersResponse' reason: AWS IAM operation listing SAML identity providers — identity federation configuration, squarely Identity & Access Management. Title's 'API Gateway' framing is the split-spec artefact; the operations are IAM. - tag: '#Action=ListSSHPublicKeys' spec_file: engineering-platform-action-listsshpublickeys-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: 'GET_ListSSHPublicKeys; schemas: SSHPublicKeyMetadata, publicKeyIdType, userNameType' reason: Lists SSH public keys associated with IAM users — user credential administration, an Identity & Access Management function. - tag: '#Action=ListServiceSpecificCredentials' spec_file: engineering-platform-action-listservicespecificcredentials-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: ListServiceSpecificCredentialsResponse, ServiceSpecificCredentialMetadata, serviceUserName reason: Enumerates service-specific credentials for IAM users — credential lifecycle, an Identity & Access Management capability. - tag: '#Action=ListUsers' spec_file: engineering-platform-action-listusers-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: ListUsersResponse, User, AttachedPermissionsBoundary, PermissionsBoundaryAttachmentType reason: Lists IAM user principals with attached permissions boundaries — machine/technical identity administration, not HR employee records. - tag: '#Action=RemoveClientIDFromOpenIDConnectProvider' spec_file: engineering-platform-action-removeclientidfromopenidconnectprovider-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.88 evidence: RemoveClientIDFromOpenIDConnectProviderRequest, clientIDType reason: Management of OIDC federation provider client IDs — identity federation, a core IAM function. - tag: '#Action=AddClientIDToOpenIDConnectProvider' spec_file: engineering-platform-action-addclientidtoopenidconnectprovider-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: AddClientIDToOpenIDConnectProviderRequest; clientIDType; arnType (AddClientIDToOpenIDConnectProvider) reason: 'Despite the API Gateway title, the operation and schemas are AWS IAM: registering a client ID with an OIDC identity provider — identity federation, i.e. Identity & Access Management.' - tag: '#Action=AddRoleToInstanceProfile' spec_file: engineering-platform-action-addroletoinstanceprofile-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: AddRoleToInstanceProfileRequest; roleNameType; instanceProfileNameType reason: IAM operation binding a role to an instance profile — machine identity and access-rights administration, mapping to Identity & Access Management (title's 'API Gateway' is spec-splitting noise). - tag: '#Action=CreateGroup' spec_file: engineering-platform-action-creategroup-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: CreateGroupRequest, groupNameType, Group, pathType, arnType reason: Creation of an IAM group used to assign permissions to users — access management, not HR org structure. - tag: '#Action=CreatePolicy' spec_file: engineering-platform-action-createpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: CreatePolicyRequest, policyDocumentType, MalformedPolicyDocumentException, attachmentCountType reason: Creates an IAM access-control policy document; this is access permission definition, not corporate policy management (BC-130.20). - tag: '#Action=CreatePolicyVersion' spec_file: engineering-platform-action-createpolicyversion-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: CreatePolicyVersionRequest, PolicyVersion, policyDocumentType, policyVersionIdType reason: Versioning of IAM access-control policy documents — access management, not compliance policy lifecycle. - tag: '#Action=CreateServiceLinkedRole' spec_file: engineering-platform-action-createservicelinkedrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: 'POST_CreateServiceLinkedRole; schemas: CreateServiceLinkedRoleRequest, policyDocumentType, roleNameType, AttachedPermissionsBoundary, RoleLastUsed' reason: Despite the API Gateway title, the operations and schemas are AWS IAM role creation — policy documents, role names, permissions boundaries. That is identity and access administration, i.e. Identity & Access Management. - tag: '#Action=CreateServiceSpecificCredential' spec_file: engineering-platform-action-createservicespecificcredential-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: 'schemas: ServiceSpecificCredential, serviceSpecificCredentialId, servicePassword, serviceUserName' reason: Operation issues a service-specific credential (username/password) for an IAM user — credential issuance and lifecycle, squarely Identity & Access Management. - tag: '#Action=DeleteAccessKey' spec_file: engineering-platform-action-deleteaccesskey-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: 'schemas: DeleteAccessKeyRequest, accessKeyIdType, existingUserNameType' reason: Revoking a user's access key is credential lifecycle management, part of Identity & Access Management. - tag: '#Action=DeleteGroup' spec_file: engineering-platform-action-deletegroup-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: 'schemas: DeleteGroupRequest, groupNameType, DeleteConflictException' reason: IAM group deletion — access group administration, i.e. Identity & Access Management, not organisational HR grouping. - tag: '#Action=DeleteLoginProfile' spec_file: engineering-platform-action-deleteloginprofile-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: 'schemas: DeleteLoginProfileRequest, userNameType, EntityTemporarilyUnmodifiableException' reason: Removes a user's console login (password) profile — user credential lifecycle, Identity & Access Management. - tag: '#Action=DeleteOpenIDConnectProvider' spec_file: engineering-platform-action-deleteopenidconnectprovider-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: DeleteOpenIDConnectProviderRequest; GET_DeleteOpenIDConnectProvider reason: AWS IAM operation deleting an OIDC identity provider — federation/identity provider administration, i.e. Identity & Access Management. - tag: '#Action=DeleteRole' spec_file: engineering-platform-action-deleterole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: roleNameType, DeleteRoleRequest, UnmodifiableEntityException reason: IAM role deletion — role-based access administration. - tag: '#Action=DeleteRolePermissionsBoundary' spec_file: engineering-platform-action-deleterolepermissionsboundary-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: DeleteRolePermissionsBoundaryRequest, roleNameType reason: Removing a permissions boundary from an IAM role — access permission administration. - tag: '#Action=DeleteRolePolicy' spec_file: engineering-platform-action-deleterolepolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: roleNameType, policyNameType, DeleteRolePolicyRequest reason: Deletes an inline access policy attached to an IAM role — identity and access permission management. - tag: '#Action=DeleteSAMLProvider' spec_file: engineering-platform-action-deletesamlprovider-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: DeleteSAMLProviderRequest, arnType reason: SAML identity provider (federation) deletion in IAM — federation lifecycle under Identity & Access Management. - tag: '#Action=GetCredentialReport' spec_file: engineering-platform-action-getcredentialreport-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: 'GET_GetCredentialReport; schemas: CredentialReportNotReadyException, ReportContentType, CredentialReportExpiredException' reason: Retrieves the IAM credential report on account credentials/keys — credential governance under Identity & Access Management. - tag: '#Action=GetLoginProfile' spec_file: engineering-platform-action-getloginprofile-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: 'GET_GetLoginProfile; schemas: LoginProfile, userNameType, GetLoginProfileResponse' reason: Retrieves an IAM user's console login profile (password credential) — user credential administration under IAM. - tag: '#Action=GetOpenIDConnectProvider' spec_file: engineering-platform-action-getopenidconnectprovider-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: 'GET_GetOpenIDConnectProvider; schemas: OpenIDConnectProviderUrlType, clientIDListType, thumbprintListType' reason: Manages OIDC identity provider registration for federated access — identity federation, a core IAM function. - tag: '#Action=GetPolicy' spec_file: engineering-platform-action-getpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: 'GET_GetPolicy; schemas: GetPolicyRequest, Policy, policyNameType, attachmentCountType, arnType, policyVersionIdType' reason: Despite the title naming API Gateway, the operation and schemas are AWS IAM managed-policy retrieval (policy ARNs, versions, attachment counts) — i.e. access-permission administration, mapping to Identity & Access Management. - tag: '#Action=GetPolicyVersion' spec_file: engineering-platform-action-getpolicyversion-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: 'GET_GetPolicyVersion; schemas: PolicyVersion, policyDocumentType, GetPolicyVersionResponse' reason: IAM policy-document/version retrieval — retrieval of access-control policy documents is identity and access management, not the API Gateway product implied by the title. - tag: '#Action=GetSSHPublicKey' spec_file: engineering-platform-action-getsshpublickey-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: SSHPublicKey, publicKeyMaterialType, publicKeyFingerprintType, userNameType reason: Retrieval of a user's SSH public credential from IAM — user credential management, i.e. IAM. - tag: '#Action=GetUser' spec_file: engineering-platform-action-getuser-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: GetUserRequest, User, userNameType, AttachedPermissionsBoundary reason: Retrieval of an IAM user principal with its permissions boundary — identity administration, not customer or employee master data. - tag: '#Action=ListAccessKeys' spec_file: engineering-platform-action-listaccesskeys-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: GET_ListAccessKeys; schemas AccessKeyMetadata, accessKeyIdType, existingUserNameType reason: AWS IAM action listing a user's access keys — issuance/stewardship of credentials for identity and access, i.e. Identity & Access Management. - tag: '#Action=ListEntitiesForPolicy' spec_file: engineering-platform-action-listentitiesforpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: ListEntitiesForPolicyResponse, PolicyUserListType, PolicyRoleListType, PolicyGroupListType reason: Enumerates users, groups and roles bound to an IAM permission policy — access rights administration. - tag: '#Action=ListGroupPolicies' spec_file: engineering-platform-action-listgrouppolicies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: ListGroupPoliciesResponse, policyNameListType, groupNameType reason: Lists inline IAM permission policies for a group — access permission administration. - tag: '#Action=ListGroupsForUser' spec_file: engineering-platform-action-listgroupsforuser-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: ListGroupsForUserResponse, groupListType, existingUserNameType reason: Resolves IAM group membership for a user — access entitlement/identity administration. - tag: '#Action=ListPolicies' spec_file: engineering-platform-action-listpolicies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: schemas Policy, policyDocumentType-adjacent policyNameType, policyScopeType, PolicyUsageType, attachmentCountType reason: IAM managed access policies, not corporate policy documents. Listing access-control policies and their attachment counts is Identity & Access Management; the homograph 'Policy' here is an authorisation artefact. - tag: '#Action=ListSigningCertificates' spec_file: engineering-platform-action-listsigningcertificates-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: SigningCertificate, certificateIdType, existingUserNameType, ListSigningCertificatesResponse reason: Lists X.509 signing certificates attached to an IAM user — user credential administration under IAM. - tag: '#Action=RemoveRoleFromInstanceProfile' spec_file: engineering-platform-action-removerolefrominstanceprofile-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: RemoveRoleFromInstanceProfileRequest, roleNameType, instanceProfileNameType reason: IAM role/instance-profile association management — machine identity and access management. - tag: '#Action=ResetServiceSpecificCredential' spec_file: engineering-platform-action-resetservicespecificcredential-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: ResetServiceSpecificCredentialRequest, servicePassword, ServiceSpecificCredential reason: Credential reset/rotation for IAM service-specific credentials — access credential management. - tag: '#Action=SetDefaultPolicyVersion' spec_file: engineering-platform-action-setdefaultpolicyversion-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: SetDefaultPolicyVersionRequest, policyVersionIdType, arnType reason: Selecting the active version of an IAM access policy — access policy administration, not corporate policy management. - tag: '#Action=SimulateCustomPolicy' spec_file: engineering-platform-action-simulatecustompolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: EvaluationResult, PolicyEvaluationException, PermissionsBoundaryDecisionDetail reason: Simulates IAM authorisation decisions against policy documents — access policy evaluation/testing within IAM. - tag: '#Action=SimulatePrincipalPolicy' spec_file: engineering-platform-action-simulateprincipalpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: EvaluationResult, PolicySourceType, PermissionsBoundaryDecisionDetail, arnType reason: Evaluates effective permissions for an IAM principal — access decision simulation, part of identity and access management. - tag: '#Action=UpdateAccessKey' spec_file: engineering-platform-action-updateaccesskey-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: UpdateAccessKeyRequest, accessKeyIdType, statusType, existingUserNameType reason: Rotating/enabling IAM access-key credentials for a user is squarely credential and access management. - tag: '#Action=UpdateAccountPasswordPolicy' spec_file: engineering-platform-action-updateaccountpasswordpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: passwordReusePreventionType, maxPasswordAgeType, minimumPasswordLengthType, UpdateAccountPasswordPolicyRequest reason: Setting account password strength/rotation policy is an identity and access control configuration. - tag: '#Action=UpdateAssumeRolePolicy' spec_file: engineering-platform-action-updateassumerolepolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: UpdateAssumeRolePolicyRequest, policyDocumentType, roleNameType, MalformedPolicyDocumentException reason: Updating the trust policy that governs who may assume an IAM role is access-policy management, not corporate Policy Management. - tag: '#Action=UpdateLoginProfile' spec_file: engineering-platform-action-updateloginprofile-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: UpdateLoginProfileRequest, passwordType, PasswordPolicyViolationException, userNameType reason: Changing an IAM user's console password is credential/identity administration. - tag: '#Action=UpdateRole' spec_file: engineering-platform-action-updaterole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: UpdateRoleRequest, roleNameType, roleMaxSessionDurationType, UnmodifiableEntityException reason: Modifying IAM role attributes including max session duration is role/access administration. - tag: '#Action=UpdateSAMLProvider' spec_file: engineering-platform-action-updatesamlprovider-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: POST_UpdateSAMLProvider with schemas 'UpdateSAMLProviderRequest', 'SAMLMetadataDocumentType' reason: AWS IAM action for updating a SAML identity-provider entity — federation configuration, i.e. identity and access management, not a business-domain capability. - tag: '#Action=UpdateUser' spec_file: engineering-platform-action-updateuser-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: POST_UpdateUser, 'UpdateUserRequest' with 'existingUserNameType', 'pathType', 'userNameType' reason: AWS IAM user record update — technical identity administration, not HR employee records. - tag: Access Application-Scoped Policies spec_file: engineering-platform-access-application-scoped-policies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: POST /accounts/{account_id}/access/apps/{app_id}/policies — "Create an Access application policy"; schemas access_okta_group_rule, access_saml_group_rule, access_ip_list_rule, access_service_token_rule, access_decision reason: Zero-trust authorisation policies binding identity-provider group rules and service tokens to an application, producing an allow/deny decision. This is squarely access management, not a business policy library. - tag: Access Applications spec_file: engineering-platform-access-applications-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: POST /accounts/{account_id}/access/apps/{app_id}/revoke_tokens — "Revoke application tokens"; GET .../user_policy_checks — "Test Access policies"; schemas access_allowed_idps, access_any_valid_service_token_rule reason: Registration of applications protected by zero-trust access, with allowed identity providers, token revocation and policy testing — access management over protected resources. - tag: Access Groups spec_file: engineering-platform-access-groups-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: POST /accounts/{account_id}/access/groups — "Create an Access group"; schemas access_email_list_rule, access_device_posture_rule, access_okta_group_rule, access_everyone_rule reason: Reusable principal groups defined by identity rules (email lists, IdP groups, device posture) used to grant access. Core Identity & Access Management, not HR group or customer segmentation. - tag: Account Roles spec_file: engineering-platform-account-roles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: GET /accounts/{account_id}/roles 'List Roles'; schemas iam_schemas-role, iam_schemas-permissions reason: Roles and permissions for account users — classic role-based access control, Identity & Access Management. Not an HR 'role' concept. - tag: Email Security spec_file: engineering-platform-email-security-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.85 evidence: email_security_get_message_detections "Get message detection details"; email_security_get_phishguard_reports "Get PhishGuard reports"; schema email-security_ThreatCategory reason: Operations investigate email messages, retrieve threat detections and phishing reports — email threat detection and investigation, squarely Threat Detection & Response. - tag: Git spec_file: engineering-platform-git-api-openapi.yml capability_id: BC-4200.40 capability_id_l1: BC-4200 capability_name: Software Construction Management confidence: 0.85 evidence: git/create-commit "Create a commit"; git/create-ref "Create a reference"; schemas git-tree, git-ref, git-tag, blob reason: Low-level Git object and reference manipulation (blobs, commits, refs, tags, trees) is source control — the core of Software Construction Management. - tag: Magic GRE Tunnels spec_file: engineering-platform-magic-gre-tunnels-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.85 evidence: '''Create GRE tunnels''; schemas magic_gre-tunnel, magic_customer_gre_endpoint, magic_mtu' reason: GRE tunnel provisioning and health checks are network infrastructure management. - tag: Magic Site LANs spec_file: engineering-platform-magic-site-lans-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.85 evidence: '''Create a new Site LAN''; schemas magic_lan_dhcp_server, magic_vlan_tag, magic_routed_subnet' reason: LAN interface, VLAN, DHCP and subnet configuration for network sites — clearly network infrastructure management. - tag: Magic Site WANs spec_file: engineering-platform-magic-site-wans-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.85 evidence: '''Create a new Site WAN''; schemas magic_wan_static_addressing, magic_vlan_tag, magic_cidr' reason: WAN interface addressing and VLAN configuration for network sites — network infrastructure management. - tag: Pages Deployment spec_file: engineering-platform-pages-deployment-api-openapi.yml capability_id: BC-4210.40 capability_id_l1: BC-4210 capability_name: Deployment Orchestration confidence: 0.85 evidence: '"Create deployment", "Retry deployment", "Rollback deployment", "Get deployment logs"' reason: Operations create, retry and roll back deployments of a project to production, which is plainly deployment orchestration within software release & deployment management. - tag: Pulls spec_file: engineering-platform-pulls-api-openapi.yml capability_id: BC-4200.40 capability_id_l1: BC-4200 capability_name: Software Construction Management confidence: 0.85 evidence: '''Create a pull request''; ''Create a review comment for a pull request''; schemas pull-request-review, pull-request-merge-result, commit' reason: GitHub pull requests, review comments, commits and merges are exactly source control and code review — software construction management. - tag: Usageplans spec_file: engineering-platform-usageplans-api-openapi.yml capability_id: BC-4270.50 capability_id_l1: BC-4270 capability_name: API Consumption Governance confidence: 0.85 evidence: POST /usageplans CreateUsagePlan; GET /usageplans/{usageplanId}/usage#startDate&endDate GetUsage; schemas QuotaSettings, UsagePlanKey, ApiStage reason: API gateway usage plans bind API keys to quota and throttle settings and report consumption — quotas, rate limits and usage analytics over API consumption, i.e. API consumption governance. - tag: Zone-Level Access Applications spec_file: engineering-platform-zone-level-access-applications-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: GET /zones/{zone_id}/access/apps 'List Access Applications'; POST .../revoke_tokens 'Revoke application tokens'; GET .../user_policy_checks 'Test Access policies'; schemas access_allowed_idps, access_scim_config_authentication_oauth2 reason: These are zero-trust Access application definitions with allowed identity providers, SCIM configuration, token revocation and user policy checks — identity and access management controls, not a business application catalogue. - tag: Zone-Level Access Policies spec_file: engineering-platform-zone-level-access-policies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.85 evidence: POST /zones/{zone_id}/access/apps/{app_id}/policies 'Create an Access policy'; schemas access_device_posture_rule, access_email_list_rule, access_azure_group_rule, access_service_token_rule, access_decision reason: CRUD over access-authorisation policies composed of identity-group, email-list, IP-list, service-token and device-posture rules that yield an allow/deny decision — access management, not corporate policy management. - tag: '#Action=GetAccessKeyLastUsed' spec_file: engineering-platform-action-getaccesskeylastused-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.82 evidence: 'schemas: accessKeyIdType, AccessKeyLastUsed, GetAccessKeyLastUsedRequest' reason: Retrieves last-used information for an IAM access key credential, part of credential lifecycle and access review under Identity & Access Management. - tag: '#Action=GetInstanceProfile' spec_file: engineering-platform-action-getinstanceprofile-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.82 evidence: 'GET_GetInstanceProfile; schemas: roleListType, roleNameType, policyDocumentType, PermissionsBoundaryAttachmentType, instanceProfileNameType' reason: Retrieves an IAM instance profile and its associated roles/policies — machine identity and access management. - tag: '#Action=ListGroups' spec_file: engineering-platform-action-listgroups-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.82 evidence: ListGroupsResponse, groupListType, groupNameType, pathPrefixType reason: Lists IAM identity groups used to grant access — identity/group administration within IAM, not HR org groups. - tag: '#Action=ListPolicyVersions' spec_file: engineering-platform-action-listpolicyversions-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.82 evidence: schemas PolicyVersion, policyDocumentType, policyDocumentVersionListType, policyVersionIdType reason: Versions of an IAM policy document (JSON authorisation policy), not a governance policy lifecycle. Belongs to Identity & Access Management. - tag: '#Action=UpdateRoleDescription' spec_file: engineering-platform-action-updateroledescription-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.82 evidence: UpdateRoleDescriptionRequest, RoleLastUsed, AttachedPermissionsBoundary, PermissionsBoundaryAttachmentType reason: IAM role metadata update with permissions-boundary and last-used schemas confirms this is access-control role management. - tag: Repos spec_file: engineering-platform-repos-api-openapi.yml capability_id: BC-4200.40 capability_id_l1: BC-4200 capability_name: Software Construction Management confidence: 0.82 evidence: GET /repos/{owner}/{repo}/branches repos/list-branches ... 'Get branch protection', 'Create an organization repository' reason: Despite the AWS API Gateway title (unreliable), the operations are GitHub repository, branch and branch-protection management — i.e. source control practice, which is Software Construction Management. Not infrastructure or API productisation. - tag: '#Action=CreateInstanceProfile' spec_file: engineering-platform-action-createinstanceprofile-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: CreateInstanceProfileRequest, roleListType, policyDocumentType, PermissionsBoundaryAttachmentType reason: Creates an IAM instance profile carrying roles/policies for compute instances — machine identity and access management. - tag: '#Action=DeleteAccountPasswordPolicy' spec_file: engineering-platform-action-deleteaccountpasswordpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: POST_DeleteAccountPasswordPolicy reason: Managing the account password policy is authentication policy administration, part of Identity & Access Management; schema context is thin (only exception types) so confidence moderated. - tag: '#Action=DeleteInstanceProfile' spec_file: engineering-platform-action-deleteinstanceprofile-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: 'schemas: DeleteInstanceProfileRequest, instanceProfileNameType' reason: IAM instance profile deletion — machine identity/role binding for compute instances, part of Identity & Access Management. - tag: '#Action=DeletePolicy' spec_file: engineering-platform-action-deletepolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: DeletePolicyRequest, DeleteConflictException, arnType reason: IAM policy deletion — access permission policy administration, not corporate policy management (BC-130.20 would be the homograph trap). - tag: '#Action=DeletePolicyVersion' spec_file: engineering-platform-action-deletepolicyversion-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: policyVersionIdType, DeletePolicyVersionRequest reason: IAM access-policy version deletion; permission management surface within identity & access management. - tag: '#Action=DeleteSSHPublicKey' spec_file: engineering-platform-action-deletesshpublickey-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: userNameType, publicKeyIdType, DeleteSSHPublicKeyRequest reason: Deletes a user's SSH public key credential — user credential administration within IAM. - tag: '#Action=DeleteServiceLinkedRole' spec_file: engineering-platform-action-deleteservicelinkedrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: roleNameType, DeleteServiceLinkedRoleRequest, DeletionTaskIdType reason: Deletion of an IAM service-linked role — machine identity/role access administration. - tag: '#Action=DeleteServiceSpecificCredential' spec_file: engineering-platform-action-deleteservicespecificcredential-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: serviceSpecificCredentialId, DeleteServiceSpecificCredentialRequest, userNameType reason: Deletes a user's service-specific credential — credential lifecycle management in IAM. - tag: '#Action=GenerateCredentialReport' spec_file: engineering-platform-action-generatecredentialreport-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: GET_GenerateCredentialReport; schemas GenerateCredentialReportResponse, ReportStateType reason: Generates an IAM credential status report used for access review; reporting artefact but scoped to identity credentials, so IAM remains the best fit. - tag: '#Action=GetContextKeysForCustomPolicy' spec_file: engineering-platform-action-getcontextkeysforcustompolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: 'GET_GetContextKeysForCustomPolicy; schemas: SimulationPolicyListType, policyDocumentType, ContextKeyNamesResultListType' reason: Inspects IAM policy documents for context keys used in policy simulation — access-policy tooling within Identity & Access Management. - tag: '#Action=GetContextKeysForPrincipalPolicy' spec_file: engineering-platform-action-getcontextkeysforprincipalpolicy-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: 'GET_GetContextKeysForPrincipalPolicy; schemas: SimulationPolicyListType, policyDocumentType, arnType' reason: Evaluates the policies attached to an IAM principal for context keys — access-policy evaluation, i.e. Identity & Access Management. - tag: '#Action=GetServiceLastAccessedDetails' spec_file: engineering-platform-action-getservicelastaccesseddetails-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: GetServiceLastAccessedDetailsResponse, ServicesLastAccessed, TrackedActionLastAccessed, AccessAdvisorUsageGranularityType reason: IAM Access Advisor data on which services a principal last accessed — used for least-privilege access review, part of Identity & Access Management. - tag: '#Action=GetServiceLastAccessedDetailsWithEntities' spec_file: engineering-platform-action-getservicelastaccesseddetailswithentities-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: GetServiceLastAccessedDetailsWithEntitiesResponse, EntityDetails, EntityInfo, userNameType reason: Reports which IAM entities (users/roles) accessed a service — access review / least-privilege analysis within IAM. - tag: '#Action=GetServiceLinkedRoleDeletionStatus' spec_file: engineering-platform-action-getservicelinkedroledeletionstatus-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: GetServiceLinkedRoleDeletionStatusResponse, DeletionTaskStatusType, RoleUsageType reason: Status of deletion of an IAM service-linked role — role lifecycle (leaver/deprovisioning) administration under IAM. - tag: '#Action=SetSecurityTokenServicePreferences' spec_file: engineering-platform-action-setsecuritytokenservicepreferences-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: SetSecurityTokenServicePreferencesRequest, globalEndpointTokenVersion reason: Configures STS session-token behaviour for the account — authentication token configuration within IAM; thin surface but unambiguously access management. - tag: '#Action=UpdateOpenIDConnectProviderThumbprint' spec_file: engineering-platform-action-updateopenidconnectproviderthumbprint-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: UpdateOpenIDConnectProviderThumbprintRequest, thumbprintListType, arnType reason: Maintaining the trust thumbprint of an OIDC identity provider is identity federation configuration within IAM. - tag: '#Action=UpdateSSHPublicKey' spec_file: engineering-platform-action-updatesshpublickey-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: '''UpdateSSHPublicKeyRequest'' with ''userNameType'', ''publicKeyIdType'', ''statusType''' reason: IAM operation managing a user's SSH public-key credential; credential lifecycle for identities maps to Identity & Access Management. - tag: '#Action=UploadSSHPublicKey' spec_file: engineering-platform-action-uploadsshpublickey-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: '''UploadSSHPublicKeyRequest'', ''SSHPublicKey'', ''publicKeyMaterialType'', ''userNameType''' reason: Uploads an SSH public key credential for an IAM user; credential issuance is Identity & Access Management. - tag: Access Reusable Policies spec_file: engineering-platform-access-reusable-policies-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: '"Create an Access reusable policy"; schemas access_okta_group_rule, access_saml_group_rule, access_device_posture_rule, access_decision' reason: CRUD over reusable access-control policies keyed on identity-provider groups, email lists, IP lists and device posture — squarely identity and access management. - tag: Account Permission Groups spec_file: engineering-platform-account-permission-groups-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: GET /accounts/{account_id}/iam/permission_groups 'List Account Permission Groups'; schemas iam_permission_group, iam_collection_permission_groups_response reason: Operations enumerate IAM permission groups under an account — access-rights administration, i.e. Identity & Access Management. No business meaning beyond security/IAM. - tag: Account Resource Groups spec_file: engineering-platform-account-resource-groups-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: POST /accounts/{account_id}/iam/resource_groups 'Create Resource Group'; schemas iam_scope, iam_create_resource_group_scope_scope_object reason: IAM resource groups define access scopes for account permissions — access management plumbing, mapped to Identity & Access Management. - tag: Actions spec_file: engineering-platform-actions-api-openapi.yml capability_id: BC-4210.10 capability_id_l1: BC-4210 capability_name: Continuous Integration Management confidence: 0.8 evidence: '''Get GitHub Actions cache usage for an enterprise''; ''Set default workflow permissions for an enterprise''; schemas workflow-run, job, runner-application, artifact' reason: GitHub Actions workflows, runners, build caches and artefacts are CI pipeline machinery — Continuous Integration Management. - tag: Code-Scanning spec_file: engineering-platform-code-scanning-api-openapi.yml capability_id: BC-620.40 capability_id_l1: BC-620 capability_name: Vulnerability Management confidence: 0.8 evidence: '"List code scanning alerts for a repository", "Upload an analysis as SARIF data", schema code-scanning-alert-severity' reason: Static analysis security alerts (SARIF, severity, alert state, dismissal) over source repositories — detection and remediation tracking of code vulnerabilities. Alternative reading as Software Quality Engineering exists, but SARIF/severity/dismissal semantics are security-vulnerability specific. - tag: Magic IPsec Tunnels spec_file: engineering-platform-magic-ipsec-tunnels-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.8 evidence: '''Create IPsec tunnels''; ''Generate Pre Shared Key (PSK) for IPsec tunnels''' reason: IPsec tunnel lifecycle and endpoint configuration — network infrastructure provisioning (PSK generation is incidental to the tunnel config). - tag: Magic Interconnects spec_file: engineering-platform-magic-interconnects-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.8 evidence: GET /accounts/{account_id}/magic/cf_interconnects — 'List interconnects'; schema magic_interconnect reason: Configuration of network interconnects (MTU, interface address, health check) — network infrastructure management. - tag: Zero Trust Organization spec_file: engineering-platform-zero-trust-organization-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: '''Revoke all Access tokens for a user''; schemas access_auth_domain, access_session_duration, access_login_design, access_service-tokens' reason: Configures the Access organization's authentication domain, session duration and token revocation — identity and access management operations, clearly BC-620.20. - tag: Zero Trust Users spec_file: engineering-platform-zero-trust-users-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.8 evidence: '''Get active sessions'', ''Get failed logins'', ''Get last seen identity''; schemas access_identity, access_device_session' reason: Read APIs over Access user identities, sessions and failed logins — identity and access management visibility, not customer or HR data. - tag: '#Action=GenerateOrganizationsAccessReport' spec_file: engineering-platform-action-generateorganizationsaccessreport-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: 'schemas: organizationsPolicyIdType, GenerateOrganizationsAccessReportRequest, organizationsEntityPathType' reason: Produces a report on service access permitted by organisation policies — access governance reporting within IAM. Slight ambiguity as it is a reporting job, hence lower confidence. - tag: '#Action=GenerateServiceLastAccessedDetails' spec_file: engineering-platform-action-generateservicelastaccesseddetails-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: 'schemas: GenerateServiceLastAccessedDetailsRequest, AccessAdvisorUsageGranularityType' reason: Access Advisor last-accessed detail generation supports least-privilege access review, an IAM activity. - tag: '#Action=ListInstanceProfiles' spec_file: engineering-platform-action-listinstanceprofiles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: instanceProfileListType, roleListType, AttachedPermissionsBoundary, PermissionsBoundaryAttachmentType reason: Lists IAM instance profiles with their roles and permissions boundaries — machine identity and access rights administration. - tag: '#Action=ListInstanceProfilesForRole' spec_file: engineering-platform-action-listinstanceprofilesforrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: ListInstanceProfilesForRoleResponse, roleNameType, instanceProfileListType, AttachedPermissionsBoundary reason: Lists IAM instance profiles associated with a role — role/machine identity access administration. - tag: '#Action=UpdateGroup' spec_file: engineering-platform-action-updategroup-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: UpdateGroupRequest, groupNameType, pathType, EntityAlreadyExistsException reason: IAM group rename/path change; groups here are permission-bearing principals, so IAM. - tag: '#Action=UpdateServiceSpecificCredential' spec_file: engineering-platform-action-updateservicespecificcredential-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: '''UpdateServiceSpecificCredentialRequest'', ''serviceSpecificCredentialId'', ''userNameType''' reason: Manages service-specific credentials attached to an IAM user — credential lifecycle within identity and access management. - tag: Account Members spec_file: engineering-platform-account-members-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: '"Add Member", "Remove Member", "Update Member"; schemas iam_permission_group, iam_member_with_policies, iam_resource_groups' reason: Account membership with permission groups, policies and scoped grants — user provisioning and authorisation administration, i.e. identity and access management. - tag: Group Provisioning spec_file: engineering-platform-group-provisioning-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.78 evidence: GET /scim/v2/Groups createScimGroup 'Create a group'; schemas scimGroupResource, scimId reason: SCIM 2.0 Group endpoints are directory/identity provisioning of user groups — identity and access management. (Tenant identity federation is an alternative reading, hence not higher.) - tag: Tunnel Routing spec_file: engineering-platform-tunnel-routing-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.78 evidence: POST /accounts/{account_id}/teamnet/routes 'Create a tunnel route'; 'Get tunnel route by IP'; schemas tunnel_ip_network, tunnel_virtual_network_id reason: CRUD over network tunnel routes and CIDR endpoints — configuration of network connectivity infrastructure, which is IT infrastructure (network) management. - tag: Tunnel Virtual Network spec_file: engineering-platform-tunnel-virtual-network-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.78 evidence: POST /accounts/{account_id}/teamnet/virtual_networks 'Create a virtual network'; schema tunnel_is_default_network reason: Creates and maintains virtual networks used for tunnel segmentation — network infrastructure provisioning and stewardship, i.e. IT infrastructure management. - tag: Workers AI Finetune spec_file: engineering-platform-workers-ai-finetune-api-openapi.yml capability_id: BC-610.60 capability_id_l1: BC-610 capability_name: Artificial Intelligence Management confidence: 0.78 evidence: POST /accounts/{account_id}/ai/finetunes — Create a new Finetune; Upload a Finetune Asset reason: Creating fine-tunes and uploading fine-tune assets is explicit ML model training/lifecycle work, squarely Artificial Intelligence Management (AI/ML model lifecycle, MLOps). - tag: '#Action=DeleteSigningCertificate' spec_file: engineering-platform-action-deletesigningcertificate-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: existingUserNameType, DeleteSigningCertificateRequest, certificateIdType reason: Deletes a user's X.509 signing certificate credential in IAM — user credential administration. - tag: '#Action=GetOrganizationsAccessReport' spec_file: engineering-platform-action-getorganizationsaccessreport-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: 'GET_GetOrganizationsAccessReport; schemas: AccessDetails, AccessDetail, serviceNamespaceType, organizationsEntityPathType' reason: Reports on service access permitted/used across organisation entities — access review reporting within Identity & Access Management. - tag: API Token Permission Groups spec_file: engineering-platform-api-token-permission-groups-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: GET /user/tokens/permission_groups — "List Token Permission Groups"; schemas iam_api-response-collection, iam_result_info reason: The path and the iam_-prefixed schemas show this enumerates the permission groups that can be attached to API tokens — access-control scoping for platform credentials, i.e. Identity & Access Management. Single read-only operation keeps confidence moderate. - tag: Account Load Balancer Pools spec_file: engineering-platform-account-load-balancer-pools-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.75 evidence: '"Create Pool", "Pool Health Details"; schemas load-balancing_origins, load-balancing_networks, load-balancing_weight' reason: Management of load-balancing origin pools, weights and networks — network/cloud infrastructure configuration within IT infrastructure management. - tag: D1 spec_file: engineering-platform-d1-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.75 evidence: POST /accounts/{account_id}/d1/database cloudflare-d1-create-database; POST /accounts/{account_id}/d1/database/{database_id}/query Query D1 Database reason: Provisioning and querying managed serverless databases — cloud infrastructure resource management, which falls under IT Infrastructure Management. - tag: IP Address Management BGP Prefixes spec_file: engineering-platform-ip-address-management-bgp-prefixes-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.75 evidence: GET /accounts/{account_id}/addressing/prefixes/{prefix_id}/bgp/prefixes 'List BGP Prefixes'; schemas addressing_asn, addressing_cidr reason: BGP prefix advertisement management is network routing/infrastructure administration, not a business capability of any other kind. - tag: IP Address Management Prefixes spec_file: engineering-platform-ip-address-management-prefixes-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.75 evidence: GET /accounts/{account_id}/addressing/prefixes 'List Prefixes'; 'Upload LOA Document' reason: IP prefix registration, LOA handling and prefix lifecycle is core IP address / network infrastructure management. - tag: Pull Requests spec_file: engineering-platform-pull-requests-api-openapi.yml capability_id: BC-4200.40 capability_id_l1: BC-4200 capability_name: Software Construction Management confidence: 0.75 evidence: POST /collections/{collectionId}/pull-requests 'Create a pull request'; POST /pull-requests/{pullRequestId}/tasks 'Review a pull request' reason: Pull-request creation and review is source-control-based change proposal and peer review, i.e. software construction practice (here applied to Postman collections). - tag: Scim spec_file: engineering-platform-scim-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.75 evidence: GET /scim/v2/Users getScimUserResources; 'List provisioned SCIM groups for an enterprise' reason: SCIM user and group provisioning endpoints are identity lifecycle/federation plumbing — identity & access management (joiner-mover-leaver provisioning). - tag: User Provisioning spec_file: engineering-platform-user-provisioning-api-openapi.yml capability_id: BC-4230.50 capability_id_l1: BC-4230 capability_name: Tenant Identity Federation confidence: 0.75 evidence: GET /scim/v2/Users getScimUserResources; POST /scim/v2/Users createScimUser; PATCH /scim/v2/Users/{userId} Update a user's state reason: SCIM 2.0 user provisioning endpoints — lifecycle of tenant user accounts via SCIM, matching Tenant Identity Federation. Alternative reading is generic IAM joiners-movers-leavers (BC-620.20), hence moderate confidence. - tag: Workers AI spec_file: engineering-platform-workers-ai-api-openapi.yml capability_id: BC-610.60 capability_id_l1: BC-610 capability_name: Artificial Intelligence Management confidence: 0.75 evidence: GET /accounts/{account_id}/ai/models/schema — Get Model Schema; POST /accounts/{account_id}/ai/run/{model_name} — Execute AI model reason: Model catalogue search, model schema retrieval and model inference execution are ML model lifecycle / MLOps operations, which is Artificial Intelligence Management. Not a product-telemetry or generic IT capability — the operations plainly run and describe ML models. - tag: Checks spec_file: engineering-platform-checks-api-openapi.yml capability_id: BC-4210.10 capability_id_l1: BC-4210 capability_name: Continuous Integration Management confidence: 0.74 evidence: checks/create "Create a check run"; checks/list-for-ref "List check runs for a Git reference"; schemas check-suite, check-annotation reason: GitHub check runs/suites report automated build and test status against commits — the pipeline policy/status surface of continuous integration. - tag: '#Action=ListUserTags' spec_file: engineering-platform-action-listusertags-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.72 evidence: ListUserTagsRequest, existingUserNameType, tagListType, Tag reason: Tag metadata on IAM user principals; part of IAM entity administration though the operation itself is metadata listing rather than access control. - tag: '#Action=UntagUser' spec_file: engineering-platform-action-untaguser-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.72 evidence: existingUserNameType, ... UntagUserRequest reason: IAM user resource tagging; the 'User' here is a cloud IAM principal, not a customer or employee, so Identity & Access Management applies. - tag: '#Action=UpdateSigningCertificate' spec_file: engineering-platform-action-updatesigningcertificate-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.72 evidence: '''UpdateSigningCertificateRequest'' with ''existingUserNameType'', ''certificateIdType'', ''statusType''' reason: IAM user signing certificate (an authentication credential) status update; treated as identity/credential administration. - tag: '#Action=UploadSigningCertificate' spec_file: engineering-platform-action-uploadsigningcertificate-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.72 evidence: '''UploadSigningCertificateRequest'', ''SigningCertificate'', ''userNameType'', ''existingUserNameType''' reason: Attaches a signing certificate credential to an IAM user — identity credential provisioning. - tag: Access Policy Tester spec_file: engineering-platform-access-policy-tester-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.72 evidence: POST /accounts/{account_id}/access/policy-tests "Start Access policy test"; schemas access_okta_group_rule, access_saml_group_rule, access_device_posture_rule-style access_decision reason: Zero-Trust access policy evaluation/testing over identity group rules and allow/deny decisions — an identity & access management control surface, not a business-domain capability. - tag: Botnet Threat Feed spec_file: engineering-platform-botnet-threat-feed-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.72 evidence: botnet-threat-feed-get-day-report "Get daily report"; botnet-threat-feed-list-asn "Get list of ASNs"; schemas dos_asn reason: Botnet/DDoS threat intelligence reporting per ASN is threat detection and response tooling within cybersecurity management. - tag: Device Posture Integrations spec_file: engineering-platform-device-posture-integrations-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.72 evidence: '''Create a device posture integration''; schemas teams-devices_intune_config_request, teams-devices_tanium_config_request, teams-devices_uptycs_config_request' reason: Integrations with endpoint security/MDM providers to evaluate device posture for zero-trust access; clearly cybersecurity but split between identity/access and security architecture, so L1 only. - tag: Device Posture Rules spec_file: engineering-platform-device-posture-rules-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.72 evidence: '''Create a device posture rule''; schemas teams-devices_disk_encryption_input_request, teams-devices_client_certificate_input_request, teams-devices_os_version_input_request' reason: Rules asserting device security state (disk encryption, OS version, certificates) used to gate access — a cybersecurity control surface; sub-capability ambiguous between IAM and security architecture. - tag: IP Address Management Address Maps spec_file: engineering-platform-ip-address-management-address-maps-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.72 evidence: POST /accounts/{account_id}/addressing/address_maps 'Create Address Map'; 'Add an IP to an Address Map' reason: Mapping IP addresses to accounts and zones is network address administration — cloud/network infrastructure management. - tag: IP Address Management Dynamic Advertisement spec_file: engineering-platform-ip-address-management-dynamic-advertisement-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.72 evidence: PATCH .../addressing/prefixes/{prefix_id}/bgp/status 'Update Prefix Dynamic Advertisement Status' reason: Controlling BGP advertisement status of IP prefixes is network infrastructure operation. 'Advertisement' here is routing, not marketing. - tag: IP Address Management Prefix Delegation spec_file: engineering-platform-ip-address-management-prefix-delegation-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.72 evidence: POST /accounts/{account_id}/addressing/prefixes/{prefix_id}/delegations 'Create Prefix Delegation' reason: Delegating IP prefixes between accounts is IP address space administration — network infrastructure management. - tag: Magic Static Routes spec_file: engineering-platform-magic-static-routes-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.72 evidence: 'GET /accounts/{account_id}/magic/routes magic-static-routes-list-routes; schemas: magic_nexthop, magic_prefix, magic_colo_region' reason: Static network routes with nexthop/prefix/colo semantics are network infrastructure configuration, mapping to IT Infrastructure Management. - tag: Roles spec_file: engineering-platform-roles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.72 evidence: PATCH /workspaces/{workspaceId}/roles updateWorkspaceRoles ... Update user or user group roles reason: Operations read and update role assignments for users and user groups on workspaces/collections — role-based access control, i.e. identity and access management. - tag: Stream Webhook spec_file: engineering-platform-stream-webhook-api-openapi.yml capability_id: BC-4270.80 capability_id_l1: BC-4270 capability_name: Webhook & Event Subscription Management confidence: 0.72 evidence: PUT /accounts/{account_id}/stream/webhook 'Create webhooks'; schema stream_notificationUrl reason: Operations create, view and delete a webhook notification URL for a service account — lifecycle of outbound webhook/event subscriptions, i.e. developer-platform webhook subscription management. Slight uncertainty because it is a single notification-URL setting rather than a full subscription catalogue. - tag: User Subscription spec_file: engineering-platform-user-subscription-api-openapi.yml capability_id: BC-4240.40 capability_id_l1: BC-4240 capability_name: Subscription Modification confidence: 0.72 evidence: GET /user/subscriptions Get User Subscriptions; DELETE /user/subscriptions/{identifier} Delete User Subscription; schemas bill-subs-api_rate_plan, bill-subs-api_current_period_start reason: Operations read, update and cancel a user's service subscriptions with rate plan and billing period schemas — in-life subscription modification/cancellation. Sub-capability split between modification and cancellation, so moderate confidence. - tag: Workers AI Text Generation spec_file: engineering-platform-workers-ai-text-generation-api-openapi.yml capability_id: BC-610.60 capability_id_l1: BC-610 capability_name: Artificial Intelligence Management confidence: 0.72 evidence: POST /accounts/{account_id}/ai/run/@cf/meta/llama-3.1-8b-instruct — Execute @cf/meta/llama-3.1-8b-instruct model. reason: Thirty-four operations that all execute hosted LLMs for text generation; this is squarely AI/ML model serving under Artificial Intelligence Management, with no other plausible business reading. - tag: '#Action=GetServerCertificate' spec_file: engineering-platform-action-getservercertificate-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: ServerCertificate, certificateBodyType, certificateChainType, ServerCertificateMetadata reason: IAM server-certificate store retrieval; credential/certificate stewardship sits under Cybersecurity Management, most closely IAM, though it could also be read as security architecture — hence moderate confidence. - tag: '#Action=ListInstanceProfileTags' spec_file: engineering-platform-action-listinstanceprofiletags-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: ListInstanceProfileTagsResponse, instanceProfileNameType, tagListType, Tag reason: Lists tags on an IAM instance profile (role container for compute identity); IAM resource metadata, so IAM is the best fit but evidence is tagging-only. - tag: '#Action=UntagRole' spec_file: engineering-platform-action-untagrole-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: 'schemas: roleNameType, tagKeyType, ... UntagRoleRequest — AWS IAM role tag removal' reason: AWS IAM action removing tags from an IAM role; the object under management is an access-control role, so it sits within Identity & Access Management. Tag housekeeping tempers confidence slightly. - tag: '#Action=UntagSAMLProvider' spec_file: engineering-platform-action-untagsamlprovider-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /#Action=UntagSAMLProvider ... UntagSAMLProviderRequest, arnType reason: IAM SAML identity-provider resource (federation) being managed; belongs to IAM/federation rather than any business capability. - tag: Access Service Tokens spec_file: engineering-platform-access-service-tokens-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: '"Create a service token", "Rotate a service token"; schemas access_client_id, access_client_secret' reason: Issuance, refresh and rotation of machine credentials (client id/secret) used to authenticate to Access-protected resources — credential lifecycle within IAM. - tag: Access mTLS Authentication spec_file: engineering-platform-access-mtls-authentication-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: '"Add an mTLS certificate", "Update an mTLS certificate''s hostname settings"; schemas access_certificates, access_fingerprint' reason: Management of client mutual-TLS certificates used to authenticate connections to protected hostnames — an authentication/credential control under IAM. - tag: Account Rulesets spec_file: engineering-platform-account-rulesets-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: schemas rulesets_BlockRule, rulesets_JsChallengeRule, rulesets_DDoSDynamicRule, rulesets_RuleAction reason: Account rulesets configure WAF/DDoS block, challenge and rewrite rules — edge security policy configuration. Clearly cybersecurity, but ambiguous between threat response and security architecture, so only L1 emitted. - tag: Account Subscriptions spec_file: engineering-platform-account-subscriptions-api-openapi.yml capability_id: BC-4240 capability_id_l1: BC-4240 capability_name: Subscription Lifecycle Management confidence: 0.7 evidence: POST /accounts/{account_id}/subscriptions 'Create Subscription'; schemas bill-subs-api_rate_plan, bill-subs-api_price, bill-subs-api_current_period_start reason: CRUD over account subscriptions with rate plans, prices and billing periods — the commercial subscription lifecycle of a SaaS/cloud account. Sub-capability ambiguous between provisioning and modification. - tag: Account-Level Custom Nameservers spec_file: engineering-platform-account-level-custom-nameservers-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.7 evidence: POST /accounts/{account_id}/custom_ns 'Add Account Custom Nameserver'; schemas dns-custom-nameservers_ns_set, dns-custom-nameservers_ns_name reason: Configuration of DNS nameservers for an account — network/DNS infrastructure administration, mapped to IT Infrastructure Management. - tag: Custom Indicator Feeds spec_file: engineering-platform-custom-indicator-feeds-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: GET /accounts/{account_id}/intel/indicator-feeds custom-indicator-feeds-get-indicator-feeds; custom-indicator-feeds_provider_name reason: Threat intelligence indicator feeds under an /intel/ path — creating, updating, sharing and downloading threat indicator data. Fits threat detection/response tooling, though the operations are largely feed management plumbing. - tag: DEX Synthetic Application Monitoring spec_file: engineering-platform-dex-synthetic-application-monitoring-api-openapi.yml capability_id: BC-4220.20 capability_id_l1: BC-4220 capability_name: Observability Management confidence: 0.7 evidence: Get details and aggregate metrics for an http test; digital-experience-monitoring_traceroute_test_result_network_path_response; List fleet status devices reason: Synthetic HTTP and traceroute tests with aggregate metrics and device fleet status — synthetic monitoring and telemetry of running services, i.e. observability. Could alternatively be classed as IT operations monitoring, hence 0.7. - tag: DLP Profiles spec_file: engineering-platform-dlp-profiles-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: GET /accounts/{account_id}/dlp/profiles/{profile_id} dlp-profiles-get-dlp-profile; dlp_CustomProfile, dlp_ExactDataEntry reason: Creation and maintenance of data-loss-prevention detection profiles and entries — configuration of a security control. Maps to Cybersecurity Management at L1; no L2 is a precise fit. - tag: Dependency-Graph spec_file: engineering-platform-dependency-graph-api-openapi.yml capability_id: BC-4200.60 capability_id_l1: BC-4200 capability_name: Open Source Stewardship confidence: 0.7 evidence: '''Export a software bill of materials (SBOM) for a repository.''; ''Create a snapshot of dependencies for a repository''' reason: SBOM export and dependency snapshots/diffs are inbound open-source supply-chain artefact stewardship for a software product. - tag: Email Security Settings spec_file: engineering-platform-email-security-settings-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: email_security_create_blocked_sender "Create a blocked email sender"; email_security_create_allow_pattern "Create an email allow pattern"; schema email-security_TrustedDomain reason: Configuration of allow/block lists and trusted domains for an email threat-protection service — tuning of security detection controls. Slightly lower confidence as it could also read as security policy/governance configuration. - tag: IP Access Rules for a User spec_file: engineering-platform-ip-access-rules-for-a-user-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: GET /user/firewall/access_rules/rules 'List IP Access rules'; schemas firewall_rule, firewall_cidr_configuration, firewall_country_configuration reason: Firewall IP access rule lifecycle is a network security control surface; maps to cybersecurity at L1 but no listed L2 cleanly covers edge firewall rule administration. - tag: IP Access Rules for an Account spec_file: engineering-platform-ip-access-rules-for-an-account-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: POST /accounts/{account_identifier}/firewall/access_rules/rules 'Create an IP Access rule' reason: Account-scoped firewall access-rule management is security control configuration; L1 cybersecurity only, as no L2 matches perimeter firewall rules precisely. - tag: IP Address Management Service Bindings spec_file: engineering-platform-ip-address-management-service-bindings-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.7 evidence: POST .../addressing/prefixes/{prefix_id}/bindings 'Create Service Binding'; schemas addressing_service_name, addressing_provisioning reason: Binding IP prefixes to network services is infrastructure provisioning of the network layer. - tag: Licenses spec_file: engineering-platform-licenses-api-openapi.yml capability_id: BC-4200.60 capability_id_l1: BC-4200 capability_name: Open Source Stewardship confidence: 0.7 evidence: GET /licenses licenses/get-all-commonly-used Get all commonly used licenses; GET /repos/{owner}/{repo}/license Get the license for a repository reason: Read-only surface over open-source licence metadata for repositories (license-simple, license-content), which supports Open Source Stewardship rather than legal IP licensing of commercial IP. - tag: Magic Account Apps spec_file: engineering-platform-magic-account-apps-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.7 evidence: GET /accounts/{account_id}/magic/apps — 'List Apps'; schemas magic_cidr, magic_app_hostnames, magic_app_subnets reason: Magic WAN application definitions keyed by CIDR, subnets and hostnames — network/cloud infrastructure configuration, not a business app catalogue. - tag: Magic Connectors spec_file: engineering-platform-magic-connectors-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.7 evidence: GET /accounts/{account_id}/magic/connectors — 'List Connectors'; schema mconn_customer_device reason: Management of network connector devices attached to the Magic WAN fabric; infrastructure (network device) management. - tag: Magic Network Monitoring Rules spec_file: engineering-platform-magic-network-monitoring-rules-api-openapi.yml capability_id: BC-600.40 capability_id_l1: BC-600 capability_name: IT Operations Management confidence: 0.7 evidence: '''Create rules'' under /mnm/rules; schemas mnm_rule_packet_threshold, mnm_rule_bandwidth_threshold' reason: Threshold-based network monitoring/alerting rules — IT operations monitoring, not business rules. - tag: Phishing URL Scanner spec_file: engineering-platform-phishing-url-scanner-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: POST /accounts/{account_id}/brand-protection/submit — 'Submit suspicious URL for scanning'; schema intel_phishing-url-submit reason: Submitting suspicious URLs for phishing analysis is a detection/response security operation. - tag: R2 Bucket spec_file: engineering-platform-r2-bucket-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.7 evidence: POST /accounts/{account_id}/r2/buckets 'Create Bucket'; schemas r2_bucket_location, r2_storage_class reason: Object-storage bucket provisioning and domain/storage-class configuration is cloud storage infrastructure management. - tag: User's Account Memberships spec_file: engineering-platform-user-s-account-memberships-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: GET /memberships List Memberships; schemas iam_membership-with-policies, iam_permission_group, iam_grants reason: IAM-prefixed schemas with permission groups, scopes and grants indicate account membership and access rights administration — identity & access management. Could also be tenant user administration; moderate confidence. - tag: Workers KV Namespace spec_file: engineering-platform-workers-kv-namespace-api-openapi.yml capability_id: BC-600.50 capability_id_l1: BC-600 capability_name: IT Infrastructure Management confidence: 0.7 evidence: GET /accounts/{account_id}/storage/kv/namespaces — "List Namespaces"; "Write multiple key-value pairs"; schema workers-kv_namespace reason: Operations provision and administer a cloud key-value storage service (namespaces, keys, values). That is cloud storage infrastructure management, not a business-domain capability. - tag: Zone-Level Access Short-Lived Certificate CAs spec_file: engineering-platform-zone-level-access-short-lived-certificate-cas-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /zones/{zone_id}/access/apps/{app_id}/ca 'Create a short-lived certificate CA'; schemas access_ca, access_public_key, access_aud reason: Short-lived certificate authorities issued per Access application are credentials used to authenticate users to protected resources, so this is identity/credential administration within access management. Slightly generic surface, hence moderate confidence. - tag: Zone-Level Access mTLS Authentication spec_file: engineering-platform-zone-level-access-mtls-authentication-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: GET /zones/{zone_id}/access/certificates 'List mTLS certificates'; schemas access_schemas-certificates, access_fingerprint, access_associated_hostnames reason: Listing client mTLS certificates used to authenticate callers to zone-protected hostnames is authentication credential management under identity and access management. Single read-only operation limits confidence. - tag: mTLS Certificate Management spec_file: engineering-platform-mtls-certificate-management-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: POST /accounts/{account_id}/mtls_certificates 'Upload mTLS certificate'; GET .../associations 'List mTLS certificate associations'; schemas tls-certificates-and-hostnames_ca, ..._components-schemas-private_key reason: Upload, retrieval, deletion and association of mutual-TLS certificates at account level is management of authentication credentials/PKI material, which sits under identity and access management rather than any business capability.