slug: indykite
provider: Indykite
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 7
edges:
- tag: Auth ZEN
  spec_file: indykite-auth-zen-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.92
  evidence: POST /access/v1/evaluation  AuthZEN specified Evaluation endpoint; POST /access/v1/search/subject  AuthZEN
    specified Subject Search API
  reason: Runtime access-decision evaluation over subjects, actions and resources (AuthZEN) — this is
    authorisation enforcement, squarely Identity & Access Management.
- tag: Authorization Policies
  spec_file: indykite-authorization-policies-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.9
  evidence: POST /authorization-policies  createAuthorizationPolicy  Create Authorization Policy
  reason: Full lifecycle management of authorization policies that govern access decisions — access policy
    administration within Identity & Access Management.
- tag: Deprecated
  spec_file: indykite-deprecated-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.78
  evidence: POST /access/v1/what-authorized 'WhatAuthorized endpoint'; POST /access/v1/who-authorized
    'WhoAuthorized endpoint'; schemas restapi.WhoAuthorizedEvaluationResponse, restapi.Action
  reason: The tag string 'Deprecated' is an API-lifecycle label, but per the rule that operations win,
    the surface evaluates who/what is authorized over nodes and actions — i.e. access decision evaluation,
    which is Identity & Access Management. Slight discount because the grouping is a deprecation bucket
    rather than a coherent business surface.
- tag: Application Agent Credentials
  spec_file: indykite-application-agent-credentials-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.75
  evidence: POST /application-agent-credentials  createApplicationAgentCredential  Register Application
    Agent credentials
  reason: Issuance, reading and deletion of credentials for machine/application identities on an identity-and-access
    platform — credential lifecycle under Identity & Access Management.
- tag: Token Introspect
  spec_file: indykite-token-introspect-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.72
  evidence: POST /token-introspects 'Create Token Introspection'; schemas httpproxy.jwtMatcher, httpproxy.claim,
    httpproxy.offlineValidation, httpproxy.onlineValidation
  reason: Configures how bearer tokens are validated and which claims are matched (JWT/opaque, online/offline
    validation) — token verification and federation configuration, squarely identity and access management.
    Held below 0.8 because the operations are configuration CRUD rather than the authentication act itself.
- tag: Application Agents
  spec_file: indykite-application-agents-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.7
  evidence: POST /application-agents  createApplicationAgent  Create Application Agent
  reason: CRUD over application agent identities (service clients) in the identity platform configuration;
    these are non-human identity principals, so Identity & Access Management is the honest fit, though
    the config-object framing leaves some ambiguity.
- tag: Service Account Credentials
  spec_file: indykite-service-account-credentials-api-openapi.yml
  capability_id: BC-620.20
  capability_id_l1: BC-620
  capability_name: Identity & Access Management
  confidence: 0.7
  evidence: POST /service-account-credentials 'Register Service Account credentials'; DELETE .../{id}
    'Delete Service Account Credential'
  reason: Issuance, reading and revocation of machine-identity credentials is identity and access management
    (credential lifecycle). Moderate confidence because it could equally be read as developer credential
    management on a platform API surface.