generated: '2026-07-15' method: generated source: openapi/mcafee-epo-openapi.yml, openapi/mcafee-esm-openapi.yml, openapi/mcafee-mvision-openapi.yml, openapi/mcafee-web-gateway-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 61 by_action_class: connected: 26 acting: 35 by_consequence: read: 26 write: 35 human_in_the_loop_required: 0 operations: - path: /core.help method: get operationId: coreHelp x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /system.find method: get operationId: systemFind x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /system.findTag method: get operationId: systemFindTag x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /system.applyTag method: post operationId: systemApplyTag x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /system.clearTag method: post operationId: systemClearTag x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /epogroup.find method: get operationId: epogroupFind x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /epogroup.moveSystem method: post operationId: epogroupMoveSystem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /policy.find method: get operationId: policyFind x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /policy.assignToSystem method: post operationId: policyAssignToSystem x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /policy.assignToGroup method: post operationId: policyAssignToGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /clienttask.find method: get operationId: clienttaskFind x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /clienttask.run method: post operationId: clienttaskRun x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /core.executeQuery method: get operationId: coreExecuteQuery x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /core.listQueries method: get operationId: coreListQueries x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /detectedsystem.find method: get operationId: detectedsystemFind x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /repository.findPackages method: get operationId: repositoryFindPackages x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scheduler.listServerTasks method: get operationId: schedulerListServerTasks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /scheduler.runServerTask method: post operationId: schedulerRunServerTask x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/login method: post operationId: login x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/logout method: delete operationId: logout x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/alarmGetTriggeredAlarms method: post operationId: getTriggeredAlarms x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/alarmAcknowledgeTriggeredAlarm method: post operationId: acknowledgeAlarm x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/alarmDeleteTriggeredAlarm method: post operationId: deleteTriggeredAlarm x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/qryExecuteDetail method: post operationId: executeQuery x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/qryGetResults method: post operationId: getQueryResults x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/sysGetWatchlists method: post operationId: getWatchlists x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/sysGetWatchlistValues method: post operationId: getWatchlistValues x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/sysAddWatchlistValues method: post operationId: addWatchlistValues x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/sysRemoveWatchlistValues method: post operationId: removeWatchlistValues x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/dsGetDataSourceList method: post operationId: getDataSources x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/caseGetCaseList method: post operationId: getCases x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/caseAddCase method: post operationId: addCase x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /v2/devGetDeviceList method: post operationId: getDevices x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /iam/v1.1/token method: post operationId: getToken x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /edr/v2/threats method: get operationId: listThreats x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /edr/v2/threats/{threatId} method: get operationId: getThreat x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /edr/v2/threats/{threatId} method: patch operationId: updateThreat x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /edr/v2/detections method: get operationId: listDetections x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /edr/v2/detections/{detectionId} method: get operationId: getDetection x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /edr/v2/devices method: get operationId: listDevices x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /edr/v2/devices/{deviceId} method: get operationId: getDevice x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /edr/v2/investigations method: get operationId: listInvestigations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /edr/v2/investigations method: post operationId: createInvestigation x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /edr/v2/remediation/actions method: post operationId: createRemediationAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /edr/v2/real-time-search method: post operationId: createRealTimeSearch x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /edr/v2/real-time-search/{searchId}/results method: get operationId: getRealTimeSearchResults x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /login method: post operationId: login x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /logout method: post operationId: logout x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /rulesets method: get operationId: listRuleSets x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /rulesets/{rulesetId} method: get operationId: getRuleSet x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /rulesets/{rulesetId} method: put operationId: updateRuleSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /rulesets/{rulesetId} method: delete operationId: deleteRuleSet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /lists method: get operationId: listLists x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /lists/{listId} method: get operationId: getList x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /lists/{listId} method: put operationId: updateList x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /lists/{listId}/entries method: post operationId: addListEntry x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /commit method: post operationId: commitChanges x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /appliance/status method: get operationId: getApplianceStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /appliance/traffic method: get operationId: getTrafficStatistics x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /file/export method: get operationId: exportConfiguration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /file/import method: post operationId: importConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required