generated: '2026-07-15' method: generated source: openapi/kibana-openapi-original.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 612 by_action_class: connected: 223 acting: 389 by_consequence: read: 223 write: 371 physical: 3 safety-critical: 15 human_in_the_loop_required: 15 operations: - path: /api/actions/connector_types method: get operationId: get-actions-connector-types x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/actions/connector/_oauth_callback method: get operationId: get-actions-connector-oauth-callback x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/actions/connector/_oauth_callback_script method: get operationId: get-actions-connector-oauth-callback-script x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/actions/connector/{id} method: delete operationId: delete-actions-connector-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/actions/connector/{id} method: get operationId: get-actions-connector-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/actions/connector/{id} method: post operationId: post-actions-connector-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/actions/connector/{id} method: put operationId: put-actions-connector-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/actions/connector/{id}/_execute method: post operationId: post-actions-connector-id-execute x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/actions/connectors method: get operationId: get-actions-connectors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/a2a/{agentId} method: post operationId: post-agent-builder-a2a-agentid x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/a2a/{agentId}.json method: get operationId: get-agent-builder-a2a-agentid.json x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/agents method: get operationId: get-agent-builder-agents x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/agents method: post operationId: post-agent-builder-agents x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/agents/{agent_id}/consumption method: post operationId: post-agent-builder-agents-agent-id-consumption x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/agents/{id} method: delete operationId: delete-agent-builder-agents-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/agents/{id} method: get operationId: get-agent-builder-agents-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/agents/{id} method: put operationId: put-agent-builder-agents-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/conversations method: get operationId: get-agent-builder-conversations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/conversations/{conversation_id} method: delete operationId: delete-agent-builder-conversations-conversation-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/conversations/{conversation_id} method: get operationId: get-agent-builder-conversations-conversation-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/conversations/{conversation_id}/attachments method: get operationId: get-agent-builder-conversations-conversation-id-attachments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/conversations/{conversation_id}/attachments method: post operationId: post-agent-builder-conversations-conversation-id-attachments x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id} method: delete operationId: delete-agent-builder-conversations-conversation-id-attachments-attachment-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id} method: patch operationId: patch-agent-builder-conversations-conversation-id-attachments-attachment-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id} method: put operationId: put-agent-builder-conversations-conversation-id-attachments-attachment-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/_restore method: post operationId: post-agent-builder-conversations-conversation-id-attachments-attachment-id-restore x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/origin method: put operationId: put-agent-builder-conversations-conversation-id-attachments-attachment-id-origin x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/conversations/{conversation_id}/attachments/stale method: get operationId: get-agent-builder-conversations-conversation-id-attachments-stale x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/converse method: post operationId: post-agent-builder-converse x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/converse/async method: post operationId: post-agent-builder-converse-async x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/mcp method: post operationId: post-agent-builder-mcp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/plugins method: get operationId: get-agent-builder-plugins x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/plugins/{pluginId} method: delete operationId: delete-agent-builder-plugins-pluginid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/plugins/{pluginId} method: get operationId: get-agent-builder-plugins-pluginid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/plugins/install method: post operationId: post-agent-builder-plugins-install x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/skills method: get operationId: get-agent-builder-skills x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/skills method: post operationId: post-agent-builder-skills x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/agent_builder/skills/{skillId} method: delete operationId: delete-agent-builder-skills-skillid x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/agent_builder/skills/{skillId} method: get operationId: get-agent-builder-skills-skillid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/skills/{skillId} method: put operationId: put-agent-builder-skills-skillid x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/agent_builder/tools method: get operationId: get-agent-builder-tools x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/tools method: post operationId: post-agent-builder-tools x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/tools/_execute method: post operationId: post-agent-builder-tools-execute x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/tools/{toolId} method: delete operationId: delete-agent-builder-tools-toolid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/agent_builder/tools/{toolId} method: get operationId: get-agent-builder-tools-toolid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/agent_builder/tools/{toolId} method: put operationId: put-agent-builder-tools-toolid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/_health method: get operationId: getAlertingHealth x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/alerting/rule_types method: get operationId: getRuleTypes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/alerting/rule/{id} method: delete operationId: delete-alerting-rule-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rule/{id} method: get operationId: get-alerting-rule-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/alerting/rule/{id} method: post operationId: post-alerting-rule-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rule/{id} method: put operationId: put-alerting-rule-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rule/{id}/_disable method: post operationId: post-alerting-rule-id-disable x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/alerting/rule/{id}/_enable method: post operationId: post-alerting-rule-id-enable x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rule/{id}/_mute_all method: post operationId: post-alerting-rule-id-mute-all x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rule/{id}/_unmute_all method: post operationId: post-alerting-rule-id-unmute-all x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rule/{id}/_update_api_key method: post operationId: post-alerting-rule-id-update-api-key x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rule/{id}/snooze_schedule method: post operationId: post-alerting-rule-id-snooze-schedule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rule/{rule_id}/alert/{alert_id}/_mute method: post operationId: post-alerting-rule-rule-id-alert-alert-id-mute x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute method: post operationId: post-alerting-rule-rule-id-alert-alert-id-unmute x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId} method: delete operationId: delete-alerting-rule-ruleid-snooze-schedule-scheduleid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rules/_find method: get operationId: get-alerting-rules-find x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/alerting/rules/backfill/_find method: post operationId: post-alerting-rules-backfill-find x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rules/backfill/_schedule method: post operationId: post-alerting-rules-backfill-schedule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rules/backfill/{id} method: delete operationId: delete-alerting-rules-backfill-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/alerting/rules/backfill/{id} method: get operationId: get-alerting-rules-backfill-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/apm/agent_keys method: post operationId: createAgentKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/apm/fleet/apm_server_schema method: post operationId: saveApmServerSchema x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/apm/services/{serviceName}/annotation method: post operationId: createAnnotation x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/apm/services/{serviceName}/annotation/search method: get operationId: getAnnotation x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/apm/settings/agent-configuration method: delete operationId: deleteAgentConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/apm/settings/agent-configuration method: get operationId: getAgentConfigurations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/apm/settings/agent-configuration method: put operationId: createUpdateAgentConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/apm/settings/agent-configuration/agent_name method: get operationId: getAgentNameForService x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/apm/settings/agent-configuration/environments method: get operationId: getEnvironmentsForService x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/apm/settings/agent-configuration/search method: post operationId: searchSingleConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/apm/settings/agent-configuration/view method: get operationId: getSingleAgentConfiguration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/apm/sourcemaps method: get operationId: getSourceMaps x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/apm/sourcemaps method: post operationId: uploadSourceMap x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/apm/sourcemaps/{id} method: delete operationId: deleteSourceMap x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/asset_criticality method: delete operationId: DeleteAssetCriticalityRecord x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/asset_criticality method: get operationId: GetAssetCriticalityRecord x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/asset_criticality method: post operationId: CreateAssetCriticalityRecord x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/asset_criticality/bulk method: post operationId: BulkUpsertAssetCriticalityRecords x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/asset_criticality/list method: get operationId: FindAssetCriticalityRecords x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/attack_discovery/_bulk method: post operationId: PostAttackDiscoveryBulk x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/attack_discovery/_find method: get operationId: AttackDiscoveryFind x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/attack_discovery/_generate method: post operationId: PostAttackDiscoveryGenerate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/attack_discovery/generations method: get operationId: GetAttackDiscoveryGenerations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/attack_discovery/generations/{execution_uuid} method: get operationId: GetAttackDiscoveryGeneration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/attack_discovery/generations/{execution_uuid}/_dismiss method: post operationId: PostAttackDiscoveryGenerationsDismiss x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/attack_discovery/schedules method: post operationId: CreateAttackDiscoverySchedules x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/attack_discovery/schedules/_find method: get operationId: FindAttackDiscoverySchedules x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/attack_discovery/schedules/{id} method: delete operationId: DeleteAttackDiscoverySchedules x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/attack_discovery/schedules/{id} method: get operationId: GetAttackDiscoverySchedules x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/attack_discovery/schedules/{id} method: put operationId: UpdateAttackDiscoverySchedules x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/attack_discovery/schedules/{id}/_disable method: post operationId: DisableAttackDiscoverySchedules x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/attack_discovery/schedules/{id}/_enable method: post operationId: EnableAttackDiscoverySchedules x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases method: delete operationId: deleteCaseDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases method: patch operationId: updateCaseDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases method: post operationId: createCaseDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases/_find method: get operationId: findCasesDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/cases/{caseId} method: get operationId: getCaseDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/cases/{caseId}/alerts method: get operationId: getCaseAlertsDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/cases/{caseId}/comments method: delete operationId: deleteCaseCommentsDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases/{caseId}/comments method: patch operationId: updateCaseCommentDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases/{caseId}/comments method: post operationId: addCaseCommentDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases/{caseId}/comments/_find method: get operationId: findCaseCommentsDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/cases/{caseId}/comments/{commentId} method: delete operationId: deleteCaseCommentDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases/{caseId}/comments/{commentId} method: get operationId: getCaseCommentDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/cases/{caseId}/connector/{connectorId}/_push method: post operationId: pushCaseDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases/{caseId}/files method: post operationId: addCaseFileDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases/{caseId}/user_actions/_find method: get operationId: findCaseActivityDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/cases/alerts/{alertId} method: get operationId: getCasesByAlertDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/cases/configure method: get operationId: getCaseConfigurationDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/cases/configure method: post operationId: setCaseConfigurationDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases/configure/{configurationId} method: patch operationId: updateCaseConfigurationDefaultSpace x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/cases/configure/connectors/_find method: get operationId: findCaseConnectorsDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/cases/reporters method: get operationId: getCaseReportersDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/cases/tags method: get operationId: getCaseTagsDefaultSpace x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/data_views method: get operationId: getAllDataViewsDefault x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/data_views/data_view method: post operationId: createDataViewDefaultw x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/data_views/data_view/{viewId} method: delete operationId: deleteDataViewDefault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/data_views/data_view/{viewId} method: get operationId: getDataViewDefault x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/data_views/data_view/{viewId} method: post operationId: updateDataViewDefault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/data_views/data_view/{viewId}/fields method: post operationId: updateFieldsMetadataDefault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/data_views/data_view/{viewId}/runtime_field method: post operationId: createRuntimeFieldDefault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/data_views/data_view/{viewId}/runtime_field method: put operationId: createUpdateRuntimeFieldDefault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/data_views/data_view/{viewId}/runtime_field/{fieldName} method: delete operationId: deleteRuntimeFieldDefault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/data_views/data_view/{viewId}/runtime_field/{fieldName} method: get operationId: getRuntimeFieldDefault x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/data_views/data_view/{viewId}/runtime_field/{fieldName} method: post operationId: updateRuntimeFieldDefault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/data_views/default method: get operationId: getDefaultDataViewDefault x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/data_views/default method: post operationId: setDefaultDatailViewDefault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/data_views/swap_references method: post operationId: swapDataViewsDefault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/data_views/swap_references/_preview method: post operationId: previewSwapDataViewsDefault x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/index method: delete operationId: DeleteAlertsIndex x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/index method: get operationId: ReadAlertsIndex x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/detection_engine/index method: post operationId: CreateAlertsIndex x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/privileges method: get operationId: ReadPrivileges x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/detection_engine/rules method: delete operationId: DeleteRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/rules method: get operationId: ReadRule x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/detection_engine/rules method: patch operationId: PatchRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/rules method: post operationId: CreateRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/rules method: put operationId: UpdateRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/rules/_bulk_action method: post operationId: PerformRulesBulkAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/rules/_export method: post operationId: ExportRules x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/rules/_find method: get operationId: FindRules x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/detection_engine/rules/_import method: post operationId: ImportRules x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/rules/{id}/exceptions method: post operationId: CreateRuleExceptionListItems x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/rules/prepackaged method: put operationId: InstallPrebuiltRulesAndTimelines x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/rules/prepackaged/_status method: get operationId: ReadPrebuiltRulesAndTimelinesStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/detection_engine/rules/preview method: post operationId: RulePreview x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/signals/assignees method: post operationId: SetAlertAssignees x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/signals/finalize_migration method: post operationId: FinalizeAlertsMigration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/signals/migration method: delete operationId: AlertsMigrationCleanup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/signals/migration method: post operationId: CreateAlertsMigration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/signals/migration_status method: get operationId: ReadAlertsMigrationStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/detection_engine/signals/search method: post operationId: SearchAlerts x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/signals/status method: post operationId: SetAlertsStatus x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/signals/tags method: post operationId: SetAlertTags x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/detection_engine/tags method: get operationId: ReadTags x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/encrypted_saved_objects/_rotate_key method: post operationId: rotateEncryptionKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint_list method: post operationId: CreateEndpointList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint_list/items method: delete operationId: DeleteEndpointListItem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint_list/items method: get operationId: ReadEndpointListItem x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint_list/items method: post operationId: CreateEndpointListItem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint_list/items method: put operationId: UpdateEndpointListItem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint_list/items/_find method: get operationId: FindEndpointListItems x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/action method: get operationId: EndpointGetActionsList x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/action_status method: get operationId: EndpointGetActionsStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/action/{action_id} method: get operationId: EndpointGetActionsDetails x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/action/{action_id}/file/{file_id} method: get operationId: EndpointFileInfo x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/action/{action_id}/file/{file_id}/download method: get operationId: EndpointFileDownload x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/action/cancel method: post operationId: CancelAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/action/execute method: post operationId: EndpointExecuteAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/action/get_file method: post operationId: EndpointGetFileAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/action/isolate method: post operationId: EndpointIsolateAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/action/kill_process method: post operationId: EndpointKillProcessAction x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/endpoint/action/memory_dump method: post operationId: EndpointGenerateMemoryDump x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/action/running_procs method: post operationId: EndpointGetProcessesAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/action/runscript method: post operationId: RunScriptAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/action/scan method: post operationId: EndpointScanAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/action/state method: get operationId: EndpointGetActionsState x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/action/suspend_process method: post operationId: EndpointSuspendProcessAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/action/unisolate method: post operationId: EndpointUnisolateAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/action/upload method: post operationId: EndpointUploadAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/endpoint/metadata method: get operationId: GetEndpointMetadataList x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/metadata/{id} method: get operationId: GetEndpointMetadata x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/policy_response method: get operationId: GetPolicyResponse x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/protection_updates_note/{package_policy_id} method: get operationId: GetProtectionUpdatesNote x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/endpoint/protection_updates_note/{package_policy_id} method: post operationId: CreateUpdateProtectionUpdatesNote x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/monitoring/engine/delete method: delete operationId: DeleteMonitoringEngine x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/monitoring/engine/disable method: post operationId: DisableMonitoringEngine x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/entity_analytics/monitoring/engine/init method: post operationId: InitMonitoringEngine x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/monitoring/engine/schedule_now method: post operationId: ScheduleMonitoringEngine x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/monitoring/privileges/health method: get operationId: PrivMonHealth x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/entity_analytics/monitoring/privileges/privileges method: get operationId: PrivMonPrivileges x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/entity_analytics/monitoring/users method: post operationId: CreatePrivMonUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/monitoring/users/_csv method: post operationId: PrivmonBulkUploadUsersCSV x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/monitoring/users/{id} method: delete operationId: DeletePrivMonUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/monitoring/users/{id} method: put operationId: UpdatePrivMonUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/monitoring/users/list method: get operationId: ListPrivMonUsers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/entity_analytics/privileged_user_monitoring/pad/install method: post operationId: InstallPrivilegedAccessDetectionPackage x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/privileged_user_monitoring/pad/status method: get operationId: GetPrivilegedAccessDetectionPackageStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/entity_analytics/watchlists method: post operationId: CreateWatchlist x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/watchlists/{id} method: get operationId: GetWatchlist x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/entity_analytics/watchlists/{id} method: put operationId: UpdateWatchlist x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/watchlists/{watchlist_id}/csv_upload method: post operationId: UploadWatchlistCsv x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/watchlists/{watchlist_id}/entities/assign method: post operationId: AssignWatchlistEntities x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/watchlists/{watchlist_id}/entities/unassign method: post operationId: UnassignWatchlistEntities x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_analytics/watchlists/list method: get operationId: ListWatchlists x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/entity_store/enable method: post operationId: InitEntityStore x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_store/engines method: delete operationId: DeleteEntityEngines x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_store/engines method: get operationId: ListEntityEngines x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/entity_store/engines/{entityType} method: delete operationId: DeleteEntityEngine x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_store/engines/{entityType} method: get operationId: GetEntityEngine x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/entity_store/engines/{entityType}/init method: post operationId: InitEntityEngine x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_store/engines/{entityType}/start method: post operationId: StartEntityEngine x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_store/engines/{entityType}/stop method: post operationId: StopEntityEngine x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/entity_store/engines/apply_dataview_indices method: post operationId: ApplyEntityEngineDataviewIndices x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_store/entities/{entityType} method: delete operationId: DeleteSingleEntity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_store/entities/{entityType} method: put operationId: UpsertEntity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_store/entities/bulk method: put operationId: UpsertEntitiesBulk x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/entity_store/entities/list method: get operationId: ListEntities x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/entity_store/status method: get operationId: GetEntityStoreStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/exception_lists method: delete operationId: DeleteExceptionList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/exception_lists method: get operationId: ReadExceptionList x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/exception_lists method: post operationId: CreateExceptionList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/exception_lists method: put operationId: UpdateExceptionList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/exception_lists/_duplicate method: post operationId: DuplicateExceptionList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/exception_lists/_export method: post operationId: ExportExceptionList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/exception_lists/_find method: get operationId: FindExceptionLists x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/exception_lists/_import method: post operationId: ImportExceptionList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/exception_lists/items method: delete operationId: DeleteExceptionListItem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/exception_lists/items method: get operationId: ReadExceptionListItem x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/exception_lists/items method: post operationId: CreateExceptionListItem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/exception_lists/items method: put operationId: UpdateExceptionListItem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/exception_lists/items/_find method: get operationId: FindExceptionListItems x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/exception_lists/summary method: get operationId: ReadExceptionListSummary x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/exceptions/shared method: post operationId: CreateSharedExceptionList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/features method: get operationId: get-features x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agent_download_sources method: get operationId: get-fleet-agent-download-sources x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agent_download_sources method: post operationId: post-fleet-agent-download-sources x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agent_download_sources/{sourceId} method: delete operationId: delete-fleet-agent-download-sources-sourceid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agent_download_sources/{sourceId} method: get operationId: get-fleet-agent-download-sources-sourceid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agent_download_sources/{sourceId} method: put operationId: put-fleet-agent-download-sources-sourceid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agent_policies method: get operationId: get-fleet-agent-policies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agent_policies method: post operationId: post-fleet-agent-policies x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agent_policies/_bulk_get method: post operationId: post-fleet-agent-policies-bulk-get x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agent_policies/{agentPolicyId} method: get operationId: get-fleet-agent-policies-agentpolicyid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agent_policies/{agentPolicyId} method: put operationId: put-fleet-agent-policies-agentpolicyid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agent_policies/{agentPolicyId}/auto_upgrade_agents_status method: get operationId: get-fleet-agent-policies-agentpolicyid-auto-upgrade-agents-status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agent_policies/{agentPolicyId}/copy method: post operationId: post-fleet-agent-policies-agentpolicyid-copy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agent_policies/{agentPolicyId}/download method: get operationId: get-fleet-agent-policies-agentpolicyid-download x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agent_policies/{agentPolicyId}/full method: get operationId: get-fleet-agent-policies-agentpolicyid-full x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agent_policies/{agentPolicyId}/outputs method: get operationId: get-fleet-agent-policies-agentpolicyid-outputs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agent_policies/delete method: post operationId: post-fleet-agent-policies-delete x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agent_policies/outputs method: post operationId: post-fleet-agent-policies-outputs x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agent_status method: get operationId: get-fleet-agent-status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agent_status/data method: get operationId: get-fleet-agent-status-data x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agentless_policies method: post operationId: post-fleet-agentless-policies x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agentless_policies/{policyId} method: delete operationId: delete-fleet-agentless-policies-policyid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents method: get operationId: get-fleet-agents x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agents method: post operationId: post-fleet-agents x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId} method: delete operationId: delete-fleet-agents-agentid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId} method: get operationId: get-fleet-agents-agentid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agents/{agentId} method: put operationId: put-fleet-agents-agentid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId}/actions method: post operationId: post-fleet-agents-agentid-actions x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId}/effective_config method: get operationId: get-fleet-agents-agentid-effective-config x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agents/{agentId}/migrate method: post operationId: post-fleet-agents-agentid-migrate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId}/privilege_level_change method: post operationId: post-fleet-agents-agentid-privilege-level-change x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId}/reassign method: post operationId: post-fleet-agents-agentid-reassign x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId}/request_diagnostics method: post operationId: post-fleet-agents-agentid-request-diagnostics x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId}/rollback method: post operationId: post-fleet-agents-agentid-rollback x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId}/unenroll method: post operationId: post-fleet-agents-agentid-unenroll x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId}/upgrade method: post operationId: post-fleet-agents-agentid-upgrade x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/{agentId}/uploads method: get operationId: get-fleet-agents-agentid-uploads x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agents/action_status method: get operationId: get-fleet-agents-action-status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agents/actions/{actionId}/cancel method: post operationId: post-fleet-agents-actions-actionid-cancel x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/available_versions method: get operationId: get-fleet-agents-available-versions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agents/bulk_migrate method: post operationId: post-fleet-agents-bulk-migrate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/bulk_privilege_level_change method: post operationId: post-fleet-agents-bulk-privilege-level-change x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/bulk_reassign method: post operationId: post-fleet-agents-bulk-reassign x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/bulk_request_diagnostics method: post operationId: post-fleet-agents-bulk-request-diagnostics x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/bulk_rollback method: post operationId: post-fleet-agents-bulk-rollback x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/bulk_unenroll method: post operationId: post-fleet-agents-bulk-unenroll x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/bulk_update_agent_tags method: post operationId: post-fleet-agents-bulk-update-agent-tags x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/bulk_upgrade method: post operationId: post-fleet-agents-bulk-upgrade x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/files/{fileId} method: delete operationId: delete-fleet-agents-files-fileid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/files/{fileId}/{fileName} method: get operationId: get-fleet-agents-files-fileid-filename x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agents/setup method: get operationId: get-fleet-agents-setup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/agents/setup method: post operationId: post-fleet-agents-setup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/agents/tags method: get operationId: get-fleet-agents-tags x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/check-permissions method: get operationId: get-fleet-check-permissions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/cloud_connectors method: get operationId: get-fleet-cloud-connectors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/cloud_connectors method: post operationId: post-fleet-cloud-connectors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/cloud_connectors/{cloudConnectorId} method: delete operationId: delete-fleet-cloud-connectors-cloudconnectorid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/cloud_connectors/{cloudConnectorId} method: get operationId: get-fleet-cloud-connectors-cloudconnectorid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/cloud_connectors/{cloudConnectorId} method: put operationId: put-fleet-cloud-connectors-cloudconnectorid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/cloud_connectors/{cloudConnectorId}/usage method: get operationId: get-fleet-cloud-connectors-cloudconnectorid-usage x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/data_streams method: get operationId: get-fleet-data-streams x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/enrollment_api_keys method: get operationId: get-fleet-enrollment-api-keys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/enrollment_api_keys method: post operationId: post-fleet-enrollment-api-keys x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/enrollment_api_keys/_bulk_delete method: post operationId: post-fleet-enrollment-api-keys-bulk-delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/fleet/enrollment_api_keys/{keyId} method: delete operationId: delete-fleet-enrollment-api-keys-keyid x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/fleet/enrollment_api_keys/{keyId} method: get operationId: get-fleet-enrollment-api-keys-keyid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/bulk_assets method: post operationId: post-fleet-epm-bulk-assets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/categories method: get operationId: get-fleet-epm-categories x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/custom_integrations method: post operationId: post-fleet-epm-custom-integrations x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/custom_integrations/{pkgName} method: put operationId: put-fleet-epm-custom-integrations-pkgname x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/data_streams method: get operationId: get-fleet-epm-data-streams x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages method: get operationId: get-fleet-epm-packages x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages method: post operationId: post-fleet-epm-packages x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/_bulk method: post operationId: post-fleet-epm-packages-bulk x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/_bulk_rollback method: post operationId: post-fleet-epm-packages-bulk-rollback x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/_bulk_rollback/{taskId} method: get operationId: get-fleet-epm-packages-bulk-rollback-taskid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages/_bulk_uninstall method: post operationId: post-fleet-epm-packages-bulk-uninstall x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/_bulk_uninstall/{taskId} method: get operationId: get-fleet-epm-packages-bulk-uninstall-taskid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages/_bulk_upgrade method: post operationId: post-fleet-epm-packages-bulk-upgrade x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/_bulk_upgrade/{taskId} method: get operationId: get-fleet-epm-packages-bulk-upgrade-taskid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages/{pkgName} method: delete operationId: delete-fleet-epm-packages-pkgname x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName} method: get operationId: get-fleet-epm-packages-pkgname x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages/{pkgName} method: post operationId: post-fleet-epm-packages-pkgname x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName} method: put operationId: put-fleet-epm-packages-pkgname x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion} method: delete operationId: delete-fleet-epm-packages-pkgname-pkgversion x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion} method: get operationId: get-fleet-epm-packages-pkgname-pkgversion x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion} method: post operationId: post-fleet-epm-packages-pkgname-pkgversion x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion} method: put operationId: put-fleet-epm-packages-pkgname-pkgversion x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath} method: get operationId: get-fleet-epm-packages-pkgname-pkgversion-filepath x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion}/datastream_assets method: delete operationId: delete-fleet-epm-packages-pkgname-pkgversion-datastream-assets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion}/dependencies method: get operationId: get-fleet-epm-packages-pkgname-pkgversion-dependencies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets method: delete operationId: delete-fleet-epm-packages-pkgname-pkgversion-kibana-assets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets method: post operationId: post-fleet-epm-packages-pkgname-pkgversion-kibana-assets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion}/rule_assets method: post operationId: post-fleet-epm-packages-pkgname-pkgversion-rule-assets x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize method: post operationId: post-fleet-epm-packages-pkgname-pkgversion-transforms-authorize x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/review_upgrade method: post operationId: post-fleet-epm-packages-pkgname-review-upgrade x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/rollback method: post operationId: post-fleet-epm-packages-pkgname-rollback x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/epm/packages/{pkgName}/stats method: get operationId: get-fleet-epm-packages-pkgname-stats x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages/installed method: get operationId: get-fleet-epm-packages-installed x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/packages/limited method: get operationId: get-fleet-epm-packages-limited x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs method: get operationId: get-fleet-epm-templates-pkgname-pkgversion-inputs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/epm/verification_key_id method: get operationId: get-fleet-epm-verification-key-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/fleet_server_hosts method: get operationId: get-fleet-fleet-server-hosts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/fleet_server_hosts method: post operationId: post-fleet-fleet-server-hosts x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/fleet_server_hosts/{itemId} method: delete operationId: delete-fleet-fleet-server-hosts-itemid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/fleet_server_hosts/{itemId} method: get operationId: get-fleet-fleet-server-hosts-itemid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/fleet_server_hosts/{itemId} method: put operationId: put-fleet-fleet-server-hosts-itemid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/health_check method: post operationId: post-fleet-health-check x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/kubernetes method: get operationId: get-fleet-kubernetes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/kubernetes/download method: get operationId: get-fleet-kubernetes-download x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/logstash_api_keys method: post operationId: post-fleet-logstash-api-keys x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/message_signing_service/rotate_key_pair method: post operationId: post-fleet-message-signing-service-rotate-key-pair x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/outputs method: get operationId: get-fleet-outputs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/outputs method: post operationId: post-fleet-outputs x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/outputs/{outputId} method: delete operationId: delete-fleet-outputs-outputid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/outputs/{outputId} method: get operationId: get-fleet-outputs-outputid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/outputs/{outputId} method: put operationId: put-fleet-outputs-outputid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/outputs/{outputId}/health method: get operationId: get-fleet-outputs-outputid-health x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/package_policies method: get operationId: get-fleet-package-policies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/package_policies method: post operationId: post-fleet-package-policies x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/package_policies/_bulk_get method: post operationId: post-fleet-package-policies-bulk-get x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/package_policies/{packagePolicyId} method: delete operationId: delete-fleet-package-policies-packagepolicyid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/package_policies/{packagePolicyId} method: get operationId: get-fleet-package-policies-packagepolicyid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/package_policies/{packagePolicyId} method: put operationId: put-fleet-package-policies-packagepolicyid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/package_policies/delete method: post operationId: post-fleet-package-policies-delete x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/package_policies/upgrade method: post operationId: post-fleet-package-policies-upgrade x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/package_policies/upgrade/dryrun method: post operationId: post-fleet-package-policies-upgrade-dryrun x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/proxies method: get operationId: get-fleet-proxies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/proxies method: post operationId: post-fleet-proxies x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/proxies/{itemId} method: delete operationId: delete-fleet-proxies-itemid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/proxies/{itemId} method: get operationId: get-fleet-proxies-itemid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/proxies/{itemId} method: put operationId: put-fleet-proxies-itemid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/remote_synced_integrations/{outputId}/remote_status method: get operationId: get-fleet-remote-synced-integrations-outputid-remote-status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/remote_synced_integrations/status method: get operationId: get-fleet-remote-synced-integrations-status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/service_tokens method: post operationId: post-fleet-service-tokens x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/settings method: get operationId: get-fleet-settings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/settings method: put operationId: put-fleet-settings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/setup method: post operationId: post-fleet-setup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/space_settings method: get operationId: get-fleet-space-settings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/space_settings method: put operationId: put-fleet-space-settings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/fleet/uninstall_tokens method: get operationId: get-fleet-uninstall-tokens x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/fleet/uninstall_tokens/{uninstallTokenId} method: get operationId: get-fleet-uninstall-tokens-uninstalltokenid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lists method: delete operationId: DeleteList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists method: get operationId: ReadList x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lists method: patch operationId: PatchList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists method: post operationId: CreateList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists method: put operationId: UpdateList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists/_find method: get operationId: FindLists x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lists/index method: delete operationId: DeleteListIndex x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists/index method: get operationId: ReadListIndex x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lists/index method: post operationId: CreateListIndex x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists/items method: delete operationId: DeleteListItem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists/items method: get operationId: ReadListItem x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lists/items method: patch operationId: PatchListItem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists/items method: post operationId: CreateListItem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists/items method: put operationId: UpdateListItem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists/items/_export method: post operationId: ExportListItems x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists/items/_find method: get operationId: FindListItems x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/lists/items/_import method: post operationId: ImportListItems x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/lists/privileges method: get operationId: ReadListPrivileges x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/logstash/pipeline/{id} method: delete operationId: delete-logstash-pipeline x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/logstash/pipeline/{id} method: get operationId: get-logstash-pipeline x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/logstash/pipeline/{id} method: put operationId: put-logstash-pipeline x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/logstash/pipelines method: get operationId: get-logstash-pipelines x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/maintenance_window method: post operationId: post-maintenance-window x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/maintenance_window/_find method: get operationId: get-maintenance-window-find x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/maintenance_window/{id} method: delete operationId: delete-maintenance-window-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/maintenance_window/{id} method: get operationId: get-maintenance-window-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/maintenance_window/{id} method: patch operationId: patch-maintenance-window-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/maintenance_window/{id}/_archive method: post operationId: post-maintenance-window-id-archive x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/maintenance_window/{id}/_unarchive method: post operationId: post-maintenance-window-id-unarchive x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/ml/saved_objects/sync method: get operationId: mlSync x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/ml/saved_objects/update_jobs_spaces method: post operationId: mlUpdateJobsSpaces x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/ml/saved_objects/update_trained_models_spaces method: post operationId: mlUpdateTrainedModelsSpaces x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/note method: delete operationId: DeleteNote x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/note method: get operationId: GetNotes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/note method: patch operationId: PersistNoteRoute x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/observability_ai_assistant/chat/complete method: post operationId: observability-ai-assistant-chat-complete x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/osquery/history method: get operationId: OsqueryGetUnifiedHistory x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/osquery/live_queries method: get operationId: OsqueryFindLiveQueries x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/osquery/live_queries method: post operationId: OsqueryCreateLiveQuery x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/osquery/live_queries/{id} method: get operationId: OsqueryGetLiveQueryDetails x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/osquery/live_queries/{id}/results/{actionId} method: get operationId: OsqueryGetLiveQueryResults x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/osquery/packs method: get operationId: OsqueryFindPacks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/osquery/packs method: post operationId: OsqueryCreatePacks x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/osquery/packs/{id} method: delete operationId: OsqueryDeletePacks x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/osquery/packs/{id} method: get operationId: OsqueryGetPacksDetails x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/osquery/packs/{id} method: put operationId: OsqueryUpdatePacks x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/osquery/packs/{id}/copy method: post operationId: OsqueryCopyPacks x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/osquery/saved_queries method: get operationId: OsqueryFindSavedQueries x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/osquery/saved_queries method: post operationId: OsqueryCreateSavedQuery x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/osquery/saved_queries/{id} method: delete operationId: OsqueryDeleteSavedQuery x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/osquery/saved_queries/{id} method: get operationId: OsqueryGetSavedQueryDetails x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/osquery/saved_queries/{id} method: put operationId: OsqueryUpdateSavedQuery x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/osquery/saved_queries/{id}/copy method: post operationId: OsqueryCopySavedQuery x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/osquery/scheduled_results/{scheduleId}/{executionCount} method: get operationId: OsqueryGetScheduledActionResults x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/osquery/scheduled_results/{scheduleId}/{executionCount}/results method: get operationId: OsqueryGetScheduledQueryResults x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/pinned_event method: patch operationId: PersistPinnedEventRoute x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/risk_score/engine/dangerously_delete_data method: delete operationId: CleanUpRiskEngine x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/risk_score/engine/saved_object/configure method: patch operationId: ConfigureRiskEngineSavedObject x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/risk_score/engine/schedule_now method: post operationId: ScheduleRiskEngineNow x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/_bulk_create method: post operationId: post-saved-objects-bulk-create x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/_bulk_delete method: post operationId: post-saved-objects-bulk-delete x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/_bulk_get method: post operationId: post-saved-objects-bulk-get x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/_bulk_resolve method: post operationId: post-saved-objects-bulk-resolve x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/_bulk_update method: put operationId: put-saved-objects-bulk-update x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/_export method: post operationId: post-saved-objects-export x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/_find method: get operationId: get-saved-objects-find x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/saved_objects/_import method: post operationId: post-saved-objects-import x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/_resolve_import_errors method: post operationId: post-saved-objects-resolve-import-errors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/{type} method: post operationId: post-saved-objects-type x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/{type}/{id} method: delete operationId: delete-saved-objects-type-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/{type}/{id} method: get operationId: get-saved-objects-type-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/saved_objects/{type}/{id} method: post operationId: post-saved-objects-type-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/{type}/{id} method: put operationId: put-saved-objects-type-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/saved_objects/resolve/{type}/{id} method: get operationId: get-saved-objects-resolve-type-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security_ai_assistant/anonymization_fields/_bulk_action method: post operationId: PerformAnonymizationFieldsBulkAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/anonymization_fields/_find method: get operationId: FindAnonymizationFields x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security_ai_assistant/chat/complete method: post operationId: ChatComplete x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/current_user/conversations method: delete operationId: DeleteAllConversations x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/current_user/conversations method: post operationId: CreateConversation x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/current_user/conversations/_find method: get operationId: FindConversations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security_ai_assistant/current_user/conversations/{id} method: delete operationId: DeleteConversation x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/current_user/conversations/{id} method: get operationId: ReadConversation x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security_ai_assistant/current_user/conversations/{id} method: put operationId: UpdateConversation x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/knowledge_base method: get operationId: GetKnowledgeBase x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security_ai_assistant/knowledge_base method: post operationId: PostKnowledgeBase x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/knowledge_base/{resource} method: get operationId: ReadKnowledgeBase x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security_ai_assistant/knowledge_base/{resource} method: post operationId: CreateKnowledgeBase x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/knowledge_base/entries method: post operationId: CreateKnowledgeBaseEntry x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/knowledge_base/entries/_bulk_action method: post operationId: PerformKnowledgeBaseEntryBulkAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/knowledge_base/entries/_find method: get operationId: FindKnowledgeBaseEntries x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security_ai_assistant/knowledge_base/entries/{id} method: delete operationId: DeleteKnowledgeBaseEntry x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/knowledge_base/entries/{id} method: get operationId: ReadKnowledgeBaseEntry x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security_ai_assistant/knowledge_base/entries/{id} method: put operationId: UpdateKnowledgeBaseEntry x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/prompts/_bulk_action method: post operationId: PerformPromptsBulkAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security_ai_assistant/prompts/_find method: get operationId: FindPrompts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security/entity_store method: put operationId: put-security-entity-store x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/entity_store/entities method: get operationId: get-security-entity-store-entities x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security/entity_store/entities/ method: delete operationId: delete-security-entity-store-entities x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/entity_store/entities/{entityType} method: post operationId: post-security-entity-store-entities-entitytype x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/entity_store/entities/{entityType} method: put operationId: put-security-entity-store-entities-entitytype x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/entity_store/entities/bulk method: put operationId: put-security-entity-store-entities-bulk x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/entity_store/install method: post operationId: post-security-entity-store-install x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/entity_store/resolution/group method: get operationId: get-security-entity-store-resolution-group x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security/entity_store/resolution/link method: post operationId: post-security-entity-store-resolution-link x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/entity_store/resolution/unlink method: post operationId: post-security-entity-store-resolution-unlink x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/entity_store/start method: put operationId: put-security-entity-store-start x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/entity_store/status method: get operationId: get-security-entity-store-status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security/entity_store/stop method: put operationId: put-security-entity-store-stop x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/security/entity_store/uninstall method: post operationId: post-security-entity-store-uninstall x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/role method: get operationId: get-security-role x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security/role/_query method: post operationId: post-security-role-query x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/role/{name} method: delete operationId: delete-security-role-name x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/role/{name} method: get operationId: get-security-role-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/security/role/{name} method: put operationId: put-security-role-name x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/roles method: post operationId: post-security-roles x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/security/session/_invalidate method: post operationId: post-security-session-invalidate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/short_url method: post operationId: post-url x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/short_url/_slug/{slug} method: get operationId: resolve-url x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/short_url/{id} method: delete operationId: delete-url x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/short_url/{id} method: get operationId: get-url x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/spaces/_copy_saved_objects method: post operationId: post-spaces-copy-saved-objects x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/spaces/_disable_legacy_url_aliases method: post operationId: post-spaces-disable-legacy-url-aliases x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/spaces/_get_shareable_references method: post operationId: post-spaces-get-shareable-references x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/spaces/_resolve_copy_saved_objects_errors method: post operationId: post-spaces-resolve-copy-saved-objects-errors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/spaces/_update_objects_spaces method: post operationId: post-spaces-update-objects-spaces x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/spaces/space method: get operationId: get-spaces-space x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/spaces/space method: post operationId: post-spaces-space x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/spaces/space/{id} method: delete operationId: delete-spaces-space-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/spaces/space/{id} method: get operationId: get-spaces-space-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/spaces/space/{id} method: put operationId: put-spaces-space-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/status method: get operationId: get-status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/streams method: get operationId: get-streams x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/streams/_disable method: post operationId: post-streams-disable x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/streams/_enable method: post operationId: post-streams-enable x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/_resync method: post operationId: post-streams-resync x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name} method: delete operationId: delete-streams-name x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name} method: get operationId: get-streams-name x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/streams/{name} method: put operationId: put-streams-name x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name}/_fork method: post operationId: post-streams-name-fork x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name}/_ingest method: get operationId: get-streams-name-ingest x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/streams/{name}/_ingest method: put operationId: put-streams-name-ingest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name}/_query method: get operationId: get-streams-name-query x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/streams/{name}/_query method: put operationId: put-streams-name-query x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name}/content/export method: post operationId: post-streams-name-content-export x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name}/content/import method: post operationId: post-streams-name-content-import x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name}/queries method: get operationId: get-streams-name-queries x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/streams/{name}/queries/_bulk method: post operationId: post-streams-name-queries-bulk x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name}/queries/{queryId} method: delete operationId: delete-streams-name-queries-queryid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name}/queries/{queryId} method: put operationId: put-streams-name-queries-queryid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name}/significant_events method: get operationId: get-streams-name-significant-events x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/streams/{name}/significant_events/_generate method: post operationId: post-streams-name-significant-events-generate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{name}/significant_events/_preview method: post operationId: post-streams-name-significant-events-preview x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{streamName}/attachments method: get operationId: get-streams-streamname-attachments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/streams/{streamName}/attachments/_bulk method: post operationId: post-streams-streamname-attachments-bulk x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{streamName}/attachments/{attachmentType}/{attachmentId} method: delete operationId: delete-streams-streamname-attachments-attachmenttype-attachmentid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/streams/{streamName}/attachments/{attachmentType}/{attachmentId} method: put operationId: put-streams-streamname-attachments-attachmenttype-attachmentid x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/monitor/test/{monitorId} method: post operationId: post-synthetics-monitor-test x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/monitors method: get operationId: get-synthetic-monitors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/synthetics/monitors method: post operationId: post-synthetic-monitors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/monitors/_bulk_delete method: post operationId: delete-synthetic-monitors x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/monitors/{id} method: delete operationId: delete-synthetic-monitor x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/monitors/{id} method: get operationId: get-synthetic-monitor x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/synthetics/monitors/{id} method: put operationId: put-synthetic-monitor x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/params method: get operationId: get-parameters x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/synthetics/params method: post operationId: post-parameters x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/params/_bulk_delete method: post operationId: delete-parameters x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/params/{id} method: delete operationId: delete-parameter x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/params/{id} method: get operationId: get-parameter x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/synthetics/params/{id} method: put operationId: put-parameter x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/private_locations method: get operationId: get-private-locations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/synthetics/private_locations method: post operationId: post-private-location x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/private_locations/{id} method: delete operationId: delete-private-location x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/synthetics/private_locations/{id} method: get operationId: get-private-location x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/synthetics/private_locations/{id} method: put operationId: put-private-location x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/task_manager/_health method: get operationId: task-manager-health x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/timeline method: delete operationId: DeleteTimelines x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/timeline method: get operationId: GetTimeline x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/timeline method: patch operationId: PatchTimeline x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/timeline method: post operationId: CreateTimelines x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/timeline/_copy method: post operationId: CopyTimeline x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/timeline/_draft method: get operationId: GetDraftTimelines x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/timeline/_draft method: post operationId: CleanDraftTimelines x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/timeline/_export method: post operationId: ExportTimelines x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/timeline/_favorite method: patch operationId: PersistFavoriteRoute x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/timeline/_import method: post operationId: ImportTimelines x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/timeline/_prepackaged method: post operationId: InstallPrepackedTimelines x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/timeline/resolve method: get operationId: ResolveTimeline x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/timelines method: get operationId: GetTimelines x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/upgrade_assistant/status method: get operationId: get-upgrade-status x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/uptime/settings method: get operationId: get-uptime-settings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/uptime/settings method: put operationId: put-uptime-settings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows method: delete operationId: delete-workflows x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows method: get operationId: get-workflows x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows method: post operationId: post-workflows x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/aggs method: get operationId: get-workflows-aggs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows/connectors method: get operationId: get-workflows-connectors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows/executions/{executionId} method: get operationId: get-workflows-executions-executionid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows/executions/{executionId}/cancel method: post operationId: post-workflows-executions-executionid-cancel x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/executions/{executionId}/children method: get operationId: get-workflows-executions-executionid-children x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows/executions/{executionId}/logs method: get operationId: get-workflows-executions-executionid-logs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows/executions/{executionId}/resume method: post operationId: post-workflows-executions-executionid-resume x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/executions/{executionId}/step/{stepExecutionId} method: get operationId: get-workflows-executions-executionid-step-stepexecutionid x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows/export method: post operationId: post-workflows-export x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/mget method: post operationId: post-workflows-mget x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/schema method: get operationId: get-workflows-schema x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows/stats method: get operationId: get-workflows-stats x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows/step/test method: post operationId: post-workflows-step-test x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/test method: post operationId: post-workflows-test x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/workflow method: post operationId: post-workflows-workflow x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/workflow/{id} method: delete operationId: delete-workflows-workflow-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/workflow/{id} method: get operationId: get-workflows-workflow-id x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows/workflow/{id} method: put operationId: put-workflows-workflow-id x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/workflow/{id}/clone method: post operationId: post-workflows-workflow-id-clone x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/workflow/{id}/run method: post operationId: post-workflows-workflow-id-run x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/workflow/{workflowId}/executions method: get operationId: get-workflows-workflow-workflowid-executions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/workflows/workflow/{workflowId}/executions/cancel method: post operationId: post-workflows-workflow-workflowid-executions-cancel x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/workflows/workflow/{workflowId}/executions/steps method: get operationId: get-workflows-workflow-workflowid-executions-steps x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /s/{spaceId}/api/observability/slos method: get operationId: findSlosOp x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /s/{spaceId}/api/observability/slos method: post operationId: createSloOp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /s/{spaceId}/api/observability/slos/_bulk_delete method: post operationId: bulkDeleteOp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /s/{spaceId}/api/observability/slos/_bulk_delete/{taskId} method: get operationId: bulkDeleteStatusOp x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /s/{spaceId}/api/observability/slos/_bulk_purge_rollup method: post operationId: deleteRollupDataOp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /s/{spaceId}/api/observability/slos/_delete_instances method: post operationId: deleteSloInstancesOp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /s/{spaceId}/api/observability/slos/{sloId} method: delete operationId: deleteSloOp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /s/{spaceId}/api/observability/slos/{sloId} method: get operationId: getSloOp x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /s/{spaceId}/api/observability/slos/{sloId} method: put operationId: updateSloOp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /s/{spaceId}/api/observability/slos/{sloId}/_reset method: post operationId: resetSloOp x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /s/{spaceId}/api/observability/slos/{sloId}/disable method: post operationId: disableSloOp x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /s/{spaceId}/api/observability/slos/{sloId}/enable method: post operationId: enableSloOp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /s/{spaceId}/internal/observability/slos/_definitions method: get operationId: getDefinitionsOp x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none