generated: '2026-07-15' method: generated source: openapi/nginx-plus-http-api-openapi.yaml, openapi/nginx-stub-status-openapi.yaml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 72 by_action_class: connected: 43 acting: 29 by_consequence: read: 43 safety-critical: 17 write: 12 human_in_the_loop_required: 17 operations: - path: / method: get operationId: getAPIEndpoints x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /nginx method: get operationId: getNginx x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /processes method: get operationId: getProcesses x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /processes method: delete operationId: deleteProcesses x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /connections method: get operationId: getConnections x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /connections method: delete operationId: deleteConnections x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /slabs/ method: get operationId: getSlabs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /slabs/{slabZoneName} method: get operationId: getSlabZone x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /slabs/{slabZoneName} method: delete operationId: deleteSlabZoneStats x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /http/ method: get operationId: getHttp x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/requests method: get operationId: getHttpRequests x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/requests method: delete operationId: deleteHttpRequests x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /http/server_zones/ method: get operationId: getHttpServerZones x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/server_zones/{httpServerZoneName} method: get operationId: getHttpServerZone x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/server_zones/{httpServerZoneName} method: delete operationId: deleteHttpServerZoneStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /http/location_zones/ method: get operationId: getHttpLocationZones x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/location_zones/{httpLocationZoneName} method: get operationId: getHttpLocationZone x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/location_zones/{httpLocationZoneName} method: delete operationId: deleteHttpLocationZoneStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /http/caches/ method: get operationId: getHttpCaches x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/caches/{httpCacheZoneName} method: get operationId: getHttpCacheZone x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/caches/{httpCacheZoneName} method: delete operationId: deleteHttpCacheZoneStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /http/limit_conns/ method: get operationId: getHttpLimitConnZones x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/limit_conns/{httpLimitConnZoneName} method: get operationId: getHttpLimitConnZone x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/limit_conns/{httpLimitConnZoneName} method: delete operationId: deleteHttpLimitConnZoneStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /http/limit_reqs/ method: get operationId: getHttpLimitReqZones x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/limit_reqs/{httpLimitReqZoneName} method: get operationId: getHttpLimitReqZone x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/limit_reqs/{httpLimitReqZoneName} method: delete operationId: deleteHttpLimitReqZoneStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /http/upstreams/ method: get operationId: getHttpUpstreams x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/upstreams/{httpUpstreamName}/ method: get operationId: getHttpUpstreamName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/upstreams/{httpUpstreamName}/ method: delete operationId: deleteHttpUpstreamStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /http/upstreams/{httpUpstreamName}/servers/ method: get operationId: getHttpUpstreamServers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/upstreams/{httpUpstreamName}/servers/ method: post operationId: postHttpUpstreamServer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /http/upstreams/{httpUpstreamName}/servers/{httpUpstreamServerId} method: get operationId: getHttpUpstreamPeer x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/upstreams/{httpUpstreamName}/servers/{httpUpstreamServerId} method: patch operationId: patchHttpUpstreamPeer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /http/upstreams/{httpUpstreamName}/servers/{httpUpstreamServerId} method: delete operationId: deleteHttpUpstreamServer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /http/keyvals/ method: get operationId: getHttpKeyvalZones x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/keyvals/{httpKeyvalZoneName} method: get operationId: getHttpKeyvalZoneKeysValues x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /http/keyvals/{httpKeyvalZoneName} method: post operationId: postHttpKeyvalZoneData x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /http/keyvals/{httpKeyvalZoneName} method: patch operationId: patchHttpKeyvalZoneKeyValue x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /http/keyvals/{httpKeyvalZoneName} method: delete operationId: deleteHttpKeyvalZoneData x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /stream/ method: get operationId: getStream x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/server_zones/ method: get operationId: getStreamServerZones x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/server_zones/{streamServerZoneName} method: get operationId: getStreamServerZone x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/server_zones/{streamServerZoneName} method: delete operationId: deleteStreamServerZoneStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /stream/limit_conns/ method: get operationId: getStreamLimitConnZones x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/limit_conns/{streamLimitConnZoneName} method: get operationId: getStreamLimitConnZone x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/limit_conns/{streamLimitConnZoneName} method: delete operationId: deleteStreamLimitConnZoneStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /stream/upstreams/ method: get operationId: getStreamUpstreams x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/upstreams/{streamUpstreamName}/ method: get operationId: getStreamUpstream x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/upstreams/{streamUpstreamName}/ method: delete operationId: deleteStreamUpstreamStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /stream/upstreams/{streamUpstreamName}/servers/ method: get operationId: getStreamUpstreamServers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/upstreams/{streamUpstreamName}/servers/ method: post operationId: postStreamUpstreamServer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /stream/upstreams/{streamUpstreamName}/servers/{streamUpstreamServerId} method: get operationId: getStreamUpstreamServer x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/upstreams/{streamUpstreamName}/servers/{streamUpstreamServerId} method: patch operationId: patchStreamUpstreamServer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /stream/upstreams/{streamUpstreamName}/servers/{streamUpstreamServerId} method: delete operationId: deleteStreamUpstreamServer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /stream/keyvals/ method: get operationId: getStreamKeyvalZones x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/keyvals/{streamKeyvalZoneName} method: get operationId: getStreamKeyvalZoneKeysValues x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /stream/keyvals/{streamKeyvalZoneName} method: post operationId: postStreamKeyvalZoneData x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /stream/keyvals/{streamKeyvalZoneName} method: patch operationId: patchStreamKeyvalZoneKeyValue x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /stream/keyvals/{streamKeyvalZoneName} method: delete operationId: deleteStreamKeyvalZoneData x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /stream/zone_sync/ method: get operationId: getStreamZoneSync x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /resolvers/ method: get operationId: getResolverZones x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /resolvers/{resolverZoneName} method: get operationId: getResolverZone x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /resolvers/{resolverZoneName} method: delete operationId: deleteResolverZoneStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /ssl method: get operationId: getSsl x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /ssl method: delete operationId: deleteSslStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /license method: get operationId: getLicense x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workers/ method: get operationId: getWorkers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workers/ method: delete operationId: deleteWorkersStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /workers/{workerId} method: get operationId: getWorker x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /workers/{workerId} method: delete operationId: deleteWorkerStat x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /stub_status method: get operationId: getStubStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none