generated: '2026-07-15' method: generated source: openapi/hashicorp-vault-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 264 by_action_class: connected: 115 acting: 149 by_consequence: read: 115 write: 132 safety-critical: 17 human_in_the_loop_required: 17 operations: - path: /auth/token/accessors/ method: get operationId: getAuthTokenAccessors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/token/create method: post operationId: postAuthTokenCreate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/create-orphan method: post operationId: postAuthTokenCreateOrphan x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/create/{role_name} method: post operationId: postAuthTokenCreateRole_name x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/lookup method: get operationId: getAuthTokenLookup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/token/lookup method: post operationId: postAuthTokenLookup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/lookup-accessor method: post operationId: postAuthTokenLookupAccessor x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/lookup-self method: get operationId: getAuthTokenLookupSelf x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/token/lookup-self method: post operationId: postAuthTokenLookupSelf x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/renew method: post operationId: postAuthTokenRenew x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/renew-accessor method: post operationId: postAuthTokenRenewAccessor x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/renew-self method: post operationId: postAuthTokenRenewSelf x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/revoke method: post operationId: postAuthTokenRevoke x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /auth/token/revoke-accessor method: post operationId: postAuthTokenRevokeAccessor x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /auth/token/revoke-orphan method: post operationId: postAuthTokenRevokeOrphan x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /auth/token/revoke-self method: post operationId: postAuthTokenRevokeSelf x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /auth/token/roles method: get operationId: getAuthTokenRoles x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/token/roles/{role_name} method: get operationId: getAuthTokenRolesRole_name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/token/roles/{role_name} method: post operationId: postAuthTokenRolesRole_name x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/roles/{role_name} method: delete operationId: deleteAuthTokenRolesRole_name x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/token/tidy method: post operationId: postAuthTokenTidy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /cubbyhole/{path} method: get operationId: getCubbyholePath x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /cubbyhole/{path} method: post operationId: postCubbyholePath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /cubbyhole/{path} method: delete operationId: deleteCubbyholePath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/alias method: post operationId: postIdentityAlias x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/alias/id method: get operationId: getIdentityAliasId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/alias/id/{id} method: get operationId: getIdentityAliasIdId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/alias/id/{id} method: post operationId: postIdentityAliasIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/alias/id/{id} method: delete operationId: deleteIdentityAliasIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/entity method: post operationId: postIdentityEntity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/entity-alias method: post operationId: postIdentityEntityAlias x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/entity-alias/id method: get operationId: getIdentityEntityAliasId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/entity-alias/id/{id} method: get operationId: getIdentityEntityAliasIdId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/entity-alias/id/{id} method: post operationId: postIdentityEntityAliasIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/entity-alias/id/{id} method: delete operationId: deleteIdentityEntityAliasIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/entity/batch-delete method: post operationId: postIdentityEntityBatchDelete x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/entity/id method: get operationId: getIdentityEntityId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/entity/id/{id} method: get operationId: getIdentityEntityIdId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/entity/id/{id} method: post operationId: postIdentityEntityIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/entity/id/{id} method: delete operationId: deleteIdentityEntityIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/entity/merge method: post operationId: postIdentityEntityMerge x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/entity/name method: get operationId: getIdentityEntityName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/entity/name/{name} method: get operationId: getIdentityEntityNameName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/entity/name/{name} method: post operationId: postIdentityEntityNameName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/entity/name/{name} method: delete operationId: deleteIdentityEntityNameName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/group method: post operationId: postIdentityGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/group-alias method: post operationId: postIdentityGroupAlias x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/group-alias/id method: get operationId: getIdentityGroupAliasId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/group-alias/id/{id} method: get operationId: getIdentityGroupAliasIdId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/group-alias/id/{id} method: post operationId: postIdentityGroupAliasIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/group-alias/id/{id} method: delete operationId: deleteIdentityGroupAliasIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/group/id method: get operationId: getIdentityGroupId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/group/id/{id} method: get operationId: getIdentityGroupIdId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/group/id/{id} method: post operationId: postIdentityGroupIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/group/id/{id} method: delete operationId: deleteIdentityGroupIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/group/name method: get operationId: getIdentityGroupName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/group/name/{name} method: get operationId: getIdentityGroupNameName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/group/name/{name} method: post operationId: postIdentityGroupNameName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/group/name/{name} method: delete operationId: deleteIdentityGroupNameName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/lookup/entity method: post operationId: postIdentityLookupEntity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/lookup/group method: post operationId: postIdentityLookupGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/.well-known/keys method: get operationId: getIdentityOidcWellKnownKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/.well-known/openid-configuration method: get operationId: getIdentityOidcWellKnownOpenidConfiguration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/assignment method: get operationId: getIdentityOidcAssignment x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/assignment/{name} method: get operationId: getIdentityOidcAssignmentName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/assignment/{name} method: post operationId: postIdentityOidcAssignmentName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/assignment/{name} method: delete operationId: deleteIdentityOidcAssignmentName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/client method: get operationId: getIdentityOidcClient x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/client/{name} method: get operationId: getIdentityOidcClientName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/client/{name} method: post operationId: postIdentityOidcClientName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/client/{name} method: delete operationId: deleteIdentityOidcClientName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/config method: get operationId: getIdentityOidcConfig x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/config method: post operationId: postIdentityOidcConfig x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/introspect method: post operationId: postIdentityOidcIntrospect x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/key method: get operationId: getIdentityOidcKey x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/key/{name} method: get operationId: getIdentityOidcKeyName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/key/{name} method: post operationId: postIdentityOidcKeyName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/key/{name} method: delete operationId: deleteIdentityOidcKeyName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/key/{name}/rotate method: post operationId: postIdentityOidcKeyNameRotate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/provider method: get operationId: getIdentityOidcProvider x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/provider/{name} method: get operationId: getIdentityOidcProviderName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/provider/{name} method: post operationId: postIdentityOidcProviderName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/provider/{name} method: delete operationId: deleteIdentityOidcProviderName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/provider/{name}/.well-known/keys method: get operationId: getIdentityOidcProviderNameWellKnownKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/provider/{name}/.well-known/openid-configuration method: get operationId: getIdentityOidcProviderNameWellKnownOpenidConfiguration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/provider/{name}/authorize method: get operationId: getIdentityOidcProviderNameAuthorize x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/provider/{name}/authorize method: post operationId: postIdentityOidcProviderNameAuthorize x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/provider/{name}/token method: post operationId: postIdentityOidcProviderNameToken x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/provider/{name}/userinfo method: get operationId: getIdentityOidcProviderNameUserinfo x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/provider/{name}/userinfo method: post operationId: postIdentityOidcProviderNameUserinfo x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/role method: get operationId: getIdentityOidcRole x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/role/{name} method: get operationId: getIdentityOidcRoleName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/role/{name} method: post operationId: postIdentityOidcRoleName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/role/{name} method: delete operationId: deleteIdentityOidcRoleName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/scope method: get operationId: getIdentityOidcScope x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/scope/{name} method: get operationId: getIdentityOidcScopeName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/oidc/scope/{name} method: post operationId: postIdentityOidcScopeName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/scope/{name} method: delete operationId: deleteIdentityOidcScopeName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/oidc/token/{name} method: get operationId: getIdentityOidcTokenName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/persona method: post operationId: postIdentityPersona x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/persona/id method: get operationId: getIdentityPersonaId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/persona/id/{id} method: get operationId: getIdentityPersonaIdId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity/persona/id/{id} method: post operationId: postIdentityPersonaIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /identity/persona/id/{id} method: delete operationId: deleteIdentityPersonaIdId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /secret/config method: get operationId: getSecretConfig x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /secret/config method: post operationId: postSecretConfig x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /secret/data/{path} method: get operationId: getSecretDataPath x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /secret/data/{path} method: post operationId: postSecretDataPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /secret/data/{path} method: delete operationId: deleteSecretDataPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /secret/delete/{path} method: post operationId: postSecretDeletePath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /secret/destroy/{path} method: post operationId: postSecretDestroyPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /secret/metadata/{path} method: get operationId: getSecretMetadataPath x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /secret/metadata/{path} method: post operationId: postSecretMetadataPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /secret/metadata/{path} method: delete operationId: deleteSecretMetadataPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /secret/undelete/{path} method: post operationId: postSecretUndeletePath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/audit method: get operationId: getSysAudit x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/audit-hash/{path} method: post operationId: postSysAuditHashPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/audit/{path} method: post operationId: postSysAuditPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/audit/{path} method: delete operationId: deleteSysAuditPath x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/auth method: get operationId: getSysAuth x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/auth/{path} method: post operationId: postSysAuthPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/auth/{path} method: delete operationId: deleteSysAuthPath x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/auth/{path}/tune method: get operationId: getSysAuthPathTune x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/auth/{path}/tune method: post operationId: postSysAuthPathTune x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/capabilities method: post operationId: postSysCapabilities x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/capabilities-accessor method: post operationId: postSysCapabilitiesAccessor x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/capabilities-self method: post operationId: postSysCapabilitiesSelf x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/config/auditing/request-headers method: get operationId: getSysConfigAuditingRequestHeaders x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/config/auditing/request-headers/{header} method: get operationId: getSysConfigAuditingRequestHeadersHeader x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/config/auditing/request-headers/{header} method: post operationId: postSysConfigAuditingRequestHeadersHeader x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/config/auditing/request-headers/{header} method: delete operationId: deleteSysConfigAuditingRequestHeadersHeader x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/config/cors method: get operationId: getSysConfigCors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/config/cors method: post operationId: postSysConfigCors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/config/cors method: delete operationId: deleteSysConfigCors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/config/reload/{subsystem} method: post operationId: postSysConfigReloadSubsystem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/config/state/sanitized method: get operationId: getSysConfigStateSanitized x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/config/ui/headers/ method: get operationId: getSysConfigUiHeaders x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/config/ui/headers/{header} method: get operationId: getSysConfigUiHeadersHeader x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/config/ui/headers/{header} method: post operationId: postSysConfigUiHeadersHeader x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/config/ui/headers/{header} method: delete operationId: deleteSysConfigUiHeadersHeader x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/generate-root method: get operationId: getSysGenerateRoot x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/generate-root method: post operationId: postSysGenerateRoot x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/generate-root method: delete operationId: deleteSysGenerateRoot x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/generate-root/attempt method: get operationId: getSysGenerateRootAttempt x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/generate-root/attempt method: post operationId: postSysGenerateRootAttempt x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/generate-root/attempt method: delete operationId: deleteSysGenerateRootAttempt x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/generate-root/update method: post operationId: postSysGenerateRootUpdate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/health method: get operationId: getSysHealth x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/host-info method: get operationId: getSysHostInfo x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/init method: get operationId: getSysInit x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/init method: post operationId: postSysInit x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/internal/counters/activity method: get operationId: getSysInternalCountersActivity x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/counters/activity/monthly method: get operationId: getSysInternalCountersActivityMonthly x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/counters/config method: get operationId: getSysInternalCountersConfig x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/counters/config method: post operationId: postSysInternalCountersConfig x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/internal/counters/entities method: get operationId: getSysInternalCountersEntities x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/counters/requests method: get operationId: getSysInternalCountersRequests x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/counters/tokens method: get operationId: getSysInternalCountersTokens x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/specs/openapi method: get operationId: getSysInternalSpecsOpenapi x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/ui/feature-flags method: get operationId: getSysInternalUiFeatureFlags x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/ui/mounts method: get operationId: getSysInternalUiMounts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/ui/mounts/{path} method: get operationId: getSysInternalUiMountsPath x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/ui/namespaces method: get operationId: getSysInternalUiNamespaces x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/internal/ui/resultant-acl method: get operationId: getSysInternalUiResultantAcl x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/key-status method: get operationId: getSysKeyStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/leader method: get operationId: getSysLeader x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/leases method: get operationId: getSysLeases x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/leases/count method: get operationId: getSysLeasesCount x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/leases/lookup method: post operationId: postSysLeasesLookup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/leases/lookup/ method: get operationId: getSysLeasesLookup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/leases/lookup/{prefix} method: get operationId: getSysLeasesLookupPrefix x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/leases/renew method: post operationId: postSysLeasesRenew x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/leases/renew/{url_lease_id} method: post operationId: postSysLeasesRenewUrl_lease_id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/leases/revoke method: post operationId: postSysLeasesRevoke x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/leases/revoke-force/{prefix} method: post operationId: postSysLeasesRevokeForcePrefix x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/leases/revoke-prefix/{prefix} method: post operationId: postSysLeasesRevokePrefixPrefix x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/leases/revoke/{url_lease_id} method: post operationId: postSysLeasesRevokeUrl_lease_id x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/leases/tidy method: post operationId: postSysLeasesTidy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/metrics method: get operationId: getSysMetrics x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/monitor method: get operationId: getSysMonitor x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/mounts method: get operationId: getSysMounts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/mounts/{path} method: post operationId: postSysMountsPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/mounts/{path} method: delete operationId: deleteSysMountsPath x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/mounts/{path}/tune method: get operationId: getSysMountsPathTune x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/mounts/{path}/tune method: post operationId: postSysMountsPathTune x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/plugins/catalog method: get operationId: getSysPluginsCatalog x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/plugins/catalog/{name} method: get operationId: getSysPluginsCatalogName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/plugins/catalog/{name} method: post operationId: postSysPluginsCatalogName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/plugins/catalog/{name} method: delete operationId: deleteSysPluginsCatalogName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/plugins/catalog/{type} method: get operationId: getSysPluginsCatalogType x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/plugins/catalog/{type}/{name} method: get operationId: getSysPluginsCatalogTypeName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/plugins/catalog/{type}/{name} method: post operationId: postSysPluginsCatalogTypeName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/plugins/catalog/{type}/{name} method: delete operationId: deleteSysPluginsCatalogTypeName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/plugins/reload/backend method: post operationId: postSysPluginsReloadBackend x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/policies/acl method: get operationId: getSysPoliciesAcl x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/policies/acl/{name} method: get operationId: getSysPoliciesAclName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/policies/acl/{name} method: post operationId: postSysPoliciesAclName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/policies/acl/{name} method: delete operationId: deleteSysPoliciesAclName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/policies/password/{name} method: get operationId: getSysPoliciesPasswordName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/policies/password/{name} method: post operationId: postSysPoliciesPasswordName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/policies/password/{name} method: delete operationId: deleteSysPoliciesPasswordName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/policies/password/{name}/generate method: get operationId: getSysPoliciesPasswordNameGenerate x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/policy method: get operationId: getSysPolicy x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/policy/{name} method: get operationId: getSysPolicyName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/policy/{name} method: post operationId: postSysPolicyName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/policy/{name} method: delete operationId: deleteSysPolicyName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/pprof/ method: get operationId: getSysPprof x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/pprof/allocs method: get operationId: getSysPprofAllocs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/pprof/block method: get operationId: getSysPprofBlock x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/pprof/cmdline method: get operationId: getSysPprofCmdline x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/pprof/goroutine method: get operationId: getSysPprofGoroutine x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/pprof/heap method: get operationId: getSysPprofHeap x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/pprof/mutex method: get operationId: getSysPprofMutex x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/pprof/profile method: get operationId: getSysPprofProfile x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/pprof/symbol method: get operationId: getSysPprofSymbol x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/pprof/threadcreate method: get operationId: getSysPprofThreadcreate x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/pprof/trace method: get operationId: getSysPprofTrace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/quotas/config method: get operationId: getSysQuotasConfig x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/quotas/config method: post operationId: postSysQuotasConfig x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/quotas/rate-limit method: get operationId: getSysQuotasRateLimit x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/quotas/rate-limit/{name} method: get operationId: getSysQuotasRateLimitName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/quotas/rate-limit/{name} method: post operationId: postSysQuotasRateLimitName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/quotas/rate-limit/{name} method: delete operationId: deleteSysQuotasRateLimitName x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/raw method: get operationId: getSysRaw x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/raw method: post operationId: postSysRaw x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/raw method: delete operationId: deleteSysRaw x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/raw/{path} method: get operationId: getSysRawPath x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/raw/{path} method: post operationId: postSysRawPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/raw/{path} method: delete operationId: deleteSysRawPath x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/rekey/backup method: get operationId: getSysRekeyBackup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/rekey/backup method: delete operationId: deleteSysRekeyBackup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/rekey/init method: get operationId: getSysRekeyInit x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/rekey/init method: post operationId: postSysRekeyInit x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/rekey/init method: delete operationId: deleteSysRekeyInit x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/rekey/recovery-key-backup method: get operationId: getSysRekeyRecoveryKeyBackup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/rekey/recovery-key-backup method: delete operationId: deleteSysRekeyRecoveryKeyBackup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/rekey/update method: post operationId: postSysRekeyUpdate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/rekey/verify method: get operationId: getSysRekeyVerify x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/rekey/verify method: post operationId: postSysRekeyVerify x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/rekey/verify method: delete operationId: deleteSysRekeyVerify x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/remount method: post operationId: postSysRemount x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/renew method: post operationId: postSysRenew x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/renew/{url_lease_id} method: post operationId: postSysRenewUrl_lease_id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/replication/status method: get operationId: getSysReplicationStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/revoke method: post operationId: postSysRevoke x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/revoke-force/{prefix} method: post operationId: postSysRevokeForcePrefix x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/revoke-prefix/{prefix} method: post operationId: postSysRevokePrefixPrefix x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/revoke/{url_lease_id} method: post operationId: postSysRevokeUrl_lease_id x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sys/rotate method: post operationId: postSysRotate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/rotate/config method: get operationId: getSysRotateConfig x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/rotate/config method: post operationId: postSysRotateConfig x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/seal method: post operationId: postSysSeal x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/seal-status method: get operationId: getSysSealStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/step-down method: post operationId: postSysStepDown x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/tools/hash method: post operationId: postSysToolsHash x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/tools/hash/{urlalgorithm} method: post operationId: postSysToolsHashUrlalgorithm x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/tools/random method: post operationId: postSysToolsRandom x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/tools/random/{urlbytes} method: post operationId: postSysToolsRandomUrlbytes x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/unseal method: post operationId: postSysUnseal x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/wrapping/lookup method: get operationId: getSysWrappingLookup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sys/wrapping/lookup method: post operationId: postSysWrappingLookup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/wrapping/rewrap method: post operationId: postSysWrappingRewrap x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/wrapping/unwrap method: post operationId: postSysWrappingUnwrap x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /sys/wrapping/wrap method: post operationId: postSysWrappingWrap x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required