generated: '2026-07-15' method: generated source: openapi/momence-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 73 by_action_class: connected: 27 acting: 46 by_consequence: read: 27 safety-critical: 46 human_in_the_loop_required: 46 operations: - path: /api/v2/auth/authorize method: get operationId: ApiV2AuthController_authorize x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/auth/token method: post operationId: ApiV2AuthController_token x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/auth/profile method: get operationId: ApiV2AuthController_profile x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/auth/logout method: post operationId: ApiV2AuthController_logout x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/appointments/reservations method: get operationId: ApiV2HostAppointmentsController_getHostAppointmentReservations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/checkout/compatible-memberships method: post operationId: ApiV2HostCheckoutController_postCompatibleMemberships x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/checkout/prices method: post operationId: ApiV2HostCheckoutController_postPrices x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/checkout method: post operationId: ApiV2HostCheckoutController_post x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId}/appointments method: get operationId: ApiV2HostMembersAppointmentsController_getAppointmentReservations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/members/{memberId}/bought-memberships/active method: get operationId: ApiV2HostMembersBoughtMembershipsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/members/{memberId}/bought-memberships/{boughtMembershipId}/credits method: put operationId: ApiV2HostMembersBoughtMembershipsController_updateClassCredits x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId}/bought-memberships/{boughtMembershipId}/membership-freeze method: put operationId: ApiV2HostMembersBoughtMembershipsController_freezeMembership x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId}/bought-memberships/{boughtMembershipId}/membership-schedule-freeze method: put operationId: ApiV2HostMembersBoughtMembershipsController_scheduleMembershipFreeze x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId}/bought-memberships/{boughtMembershipId}/membership-schedule-freeze method: delete operationId: ApiV2HostMembersBoughtMembershipsController_removeMembershipFreeze x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId}/bought-memberships/{boughtMembershipId}/membership-schedule-unfreeze method: put operationId: ApiV2HostMembersBoughtMembershipsController_scheduleMembershipUnfreeze x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId}/bought-memberships/{boughtMembershipId}/membership-schedule-unfreeze method: delete operationId: ApiV2HostMembersBoughtMembershipsController_removeMembershipUnfreeze x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members method: get operationId: ApiV2HostMembersController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/members method: post operationId: ApiV2HostMembersController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/list method: post operationId: ApiV2HostMembersController_listPost x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId} method: get operationId: ApiV2HostMembersController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/members/{memberId}/name method: put operationId: ApiV2HostMembersController_updateName x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId}/phone-number method: put operationId: ApiV2HostMembersController_updatePhoneNumber x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId}/phone-number method: delete operationId: ApiV2HostMembersController_deleteMemberPhoneNumber x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId}/email method: put operationId: ApiV2HostMembersController_updateEmail x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/memberships method: get operationId: ApiV2HostMembershipsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/members/{memberId}/notes method: get operationId: ApiV2HostMembersNotesController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/members/{memberId}/sessions method: get operationId: ApiV2HostMembersSessionBookingsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/members/{memberId}/tags/{tagId} method: post operationId: ApiV2HostMemberTagsController_assign x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/members/{memberId}/tags/{tagId} method: delete operationId: ApiV2HostMemberTagsController_unassign x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/sales method: get operationId: ApiV2HostSalesController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/session-bookings/{bookingId}/check-in method: post operationId: ApiV2HostSessionBookingCheckInController_addSessionBookingCheckIn x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/session-bookings/{bookingId}/check-in method: delete operationId: ApiV2HostSessionBookingCheckInController_removeSessionBookingCheckIn x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/session-bookings/{bookingId} method: delete operationId: ApiV2HostSessionBookingController_cancelSessionBooking x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/session-recurring-bookings/{bookingId} method: delete operationId: ApiV2HostSessionRecurringBookingController_cancelRecurringSessionBooking x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/sessions method: get operationId: ApiV2HostSessionsController_getSessions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/sessions/{sessionId} method: get operationId: ApiV2HostSessionsController_getSession x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/sessions/{sessionId}/bookings method: get operationId: ApiV2HostSessionsController_getSessionBookings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/host/sessions/{sessionId}/bookings/free method: post operationId: ApiV2HostSessionsController_addToSessionForFree x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/sessions/{sessionId}/waitlist/bookings method: post operationId: ApiV2HostSessionsController_addToWaitlist x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/tags method: get operationId: ApiV2HostTagsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member-addresses method: get operationId: ApiV2MemberAddressesController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member-addresses method: post operationId: ApiV2MemberAddressesController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member-addresses/{memberAddressId} method: get operationId: ApiV2MemberAddressesController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member-addresses/{memberAddressId} method: put operationId: ApiV2MemberAddressesController_update x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member-addresses/{memberAddressId} method: delete operationId: ApiV2MemberAddressesController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/bought-memberships/active method: get operationId: ApiV2MemberBoughtMembershipsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member/bought-memberships/{boughtMembershipId}/membership-freeze method: put operationId: ApiV2MemberBoughtMembershipsController_freezeMembership x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/bought-memberships/{boughtMembershipId}/membership-schedule-freeze method: put operationId: ApiV2MemberBoughtMembershipsController_scheduleMembershipFreeze x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/bought-memberships/{boughtMembershipId}/membership-schedule-freeze method: delete operationId: ApiV2MemberBoughtMembershipsController_removeMembershipFreeze x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/bought-memberships/{boughtMembershipId}/membership-schedule-unfreeze method: put operationId: ApiV2MemberBoughtMembershipsController_scheduleMembershipUnfreeze x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/bought-memberships/{boughtMembershipId}/membership-schedule-unfreeze method: delete operationId: ApiV2MemberBoughtMembershipsController_removeMembershipUnfreeze x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/checkout/compatible-memberships method: post operationId: ApiV2MemberCheckoutController_postCompatibleMemberships x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/checkout/prices method: post operationId: ApiV2MemberCheckoutController_postPrices x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/checkout method: post operationId: ApiV2MemberCheckoutController_post x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member method: get operationId: ApiV2MemberController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member method: put operationId: ApiV2MemberController_update x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/visits method: get operationId: ApiV2MemberController_getVisits x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member/email method: put operationId: ApiV2MemberController_updateEmail x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/phone-number method: put operationId: ApiV2MemberController_updatePhoneNumber x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/phone-number method: delete operationId: ApiV2MemberController_deletePhoneNumber x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/password-reset-email method: post operationId: ApiV2MemberController_requestPasswordResetEmail x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/host/locations method: get operationId: ApiV2MemberHostLocationsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member/host/memberships method: get operationId: ApiV2MemberHostMembershipsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member/host/sessions method: get operationId: ApiV2MemberHostSessionsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member/host/signable-documents method: get operationId: ApiV2MemberHostSignableDocumentsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member/host/signable-documents/sign method: put operationId: ApiV2MemberHostSignableDocumentsController_sign x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/saved-payment-methods method: get operationId: ApiV2MemberSavedPaymentMethodsController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member/saved-payment-methods method: post operationId: ApiV2MemberSavedPaymentMethodsController_post x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/saved-payment-methods/{savedPaymentMethodId} method: delete operationId: ApiV2MemberSavedPaymentMethodsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/member/sessions method: get operationId: ApiV2MemberSessionBookingsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/member/sessions/{sessionBookingId} method: delete operationId: ApiV2MemberSessionBookingsController_cancel x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/reports method: post operationId: ApiV2HostReportRunsController_createReportRun x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v2/host/reports/{reportRunId} method: get operationId: ApiV2HostReportRunsController_getReportRun x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none