generated: '2026-07-15' method: generated source: openapi/okta-openapi-original.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 341 by_action_class: connected: 131 acting: 210 by_consequence: read: 131 write: 188 physical: 7 safety-critical: 15 human_in_the_loop_required: 15 operations: - path: /api/v1/apps method: get operationId: listApplications x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps method: post operationId: createApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId} method: get operationId: getApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId} method: put operationId: updateApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId} method: delete operationId: deleteApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/connections/default method: get operationId: getDefaultProvisioningConnectionForApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/connections/default method: post operationId: setDefaultProvisioningConnectionForApplication x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/connections/default/lifecycle/activate method: post operationId: activateDefaultProvisioningConnectionForApplication x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/connections/default/lifecycle/deactivate method: post operationId: deactivateDefaultProvisioningConnectionForApplication x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/credentials/csrs method: get operationId: listCsrsForApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/credentials/csrs method: post operationId: generateCsrForApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/credentials/csrs/{csrId} method: get operationId: getCsrForApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/credentials/csrs/{csrId} method: delete operationId: revokeCsrFromApplication x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/apps/{appId}/credentials/csrs/{csrId}/lifecycle/publish method: post x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/credentials/keys method: get operationId: listApplicationKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/credentials/keys/generate method: post operationId: generateApplicationKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/credentials/keys/{keyId} method: get operationId: getApplicationKey x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/credentials/keys/{keyId}/clone method: post operationId: cloneApplicationKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/credentials/secrets method: get operationId: listClientSecretsForApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/credentials/secrets method: post operationId: createNewClientSecretForApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/credentials/secrets/{secretId} method: get operationId: getClientSecretForApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/credentials/secrets/{secretId} method: delete operationId: deleteClientSecretForApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/credentials/secrets/{secretId}/lifecycle/activate method: post operationId: activateClientSecretForApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/credentials/secrets/{secretId}/lifecycle/deactivate method: post operationId: deactivateClientSecretForApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/features method: get operationId: listFeaturesForApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/features/{name} method: get operationId: getFeatureForApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/features/{name} method: put operationId: updateFeatureForApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/grants method: get operationId: listScopeConsentGrants x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/grants method: post operationId: grantConsentToScope x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/grants/{grantId} method: get operationId: getScopeConsentGrant x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/grants/{grantId} method: delete operationId: revokeScopeConsentGrant x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/apps/{appId}/groups method: get operationId: listApplicationGroupAssignments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/groups/{groupId} method: get operationId: getApplicationGroupAssignment x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/groups/{groupId} method: put operationId: createApplicationGroupAssignment x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/groups/{groupId} method: delete operationId: deleteApplicationGroupAssignment x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/lifecycle/activate method: post operationId: activateApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/lifecycle/deactivate method: post operationId: deactivateApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/logo method: post operationId: uploadApplicationLogo x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/policies/{policyId} method: put operationId: updateApplicationPolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/sso/saml/metadata method: get operationId: previewSAMLAppMetadata x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/tokens method: get operationId: listOAuth2TokensForApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/tokens method: delete operationId: revokeOAuth2TokensForApplication x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/apps/{appId}/tokens/{tokenId} method: get operationId: getOAuth2TokenForApplication x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/tokens/{tokenId} method: delete operationId: revokeOAuth2TokenForApplication x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/apps/{appId}/users method: get operationId: listApplicationUsers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/users method: post operationId: assignUserToApplication x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/users/{userId} method: get operationId: getApplicationUser x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/apps/{appId}/users/{userId} method: post operationId: updateApplicationUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/apps/{appId}/users/{userId} method: delete operationId: deleteApplicationUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authenticators method: get operationId: listAuthenticators x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authenticators method: post operationId: createAuthenticator x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authenticators/{authenticatorId} method: get operationId: getAuthenticator x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authenticators/{authenticatorId} method: put operationId: updateAuthenticator x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authenticators/{authenticatorId}/lifecycle/activate method: post operationId: activateAuthenticator x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authenticators/{authenticatorId}/lifecycle/deactivate method: post operationId: deactivateAuthenticator x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers method: get operationId: listAuthorizationServers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers method: post operationId: createAuthorizationServer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId} method: get operationId: getAuthorizationServer x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId} method: put operationId: updateAuthorizationServer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId} method: delete operationId: deleteAuthorizationServer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/claims method: get operationId: listOAuth2Claims x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/claims method: post operationId: createOAuth2Claim x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/claims/{claimId} method: get operationId: getOAuth2Claim x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/claims/{claimId} method: put operationId: updateOAuth2Claim x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/claims/{claimId} method: delete operationId: deleteOAuth2Claim x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/clients method: get operationId: listOAuth2ClientsForAuthorizationServer x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/clients/{clientId}/tokens method: get operationId: listRefreshTokensForAuthorizationServerAndClient x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/clients/{clientId}/tokens method: delete operationId: revokeRefreshTokensForAuthorizationServerAndClient x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/authorizationServers/{authServerId}/clients/{clientId}/tokens/{tokenId} method: get operationId: getRefreshTokenForAuthorizationServerAndClient x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/clients/{clientId}/tokens/{tokenId} method: delete operationId: revokeRefreshTokenForAuthorizationServerAndClient x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/authorizationServers/{authServerId}/credentials/keys method: get operationId: listAuthorizationServerKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/credentials/lifecycle/keyRotate method: post operationId: rotateAuthorizationServerKeys x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/lifecycle/activate method: post operationId: activateAuthorizationServer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/lifecycle/deactivate method: post operationId: deactivateAuthorizationServer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/policies method: get operationId: listAuthorizationServerPolicies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/policies method: post operationId: createAuthorizationServerPolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId} method: get operationId: getAuthorizationServerPolicy x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId} method: put operationId: updateAuthorizationServerPolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId} method: delete operationId: deleteAuthorizationServerPolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId}/lifecycle/activate method: post operationId: activateAuthorizationServerPolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId}/lifecycle/deactivate method: post operationId: deactivateAuthorizationServerPolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules method: get operationId: listAuthorizationServerPolicyRules x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules method: post operationId: createAuthorizationServerPolicyRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/{ruleId} method: get operationId: getAuthorizationServerPolicyRule x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/{ruleId} method: put operationId: updateAuthorizationServerPolicyRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/{ruleId} method: delete operationId: deleteAuthorizationServerPolicyRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/{ruleId}/lifecycle/activate method: post operationId: activateAuthorizationServerPolicyRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate method: post operationId: deactivateAuthorizationServerPolicyRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/scopes method: get operationId: listOAuth2Scopes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/scopes method: post operationId: createOAuth2Scope x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/scopes/{scopeId} method: get operationId: getOAuth2Scope x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/authorizationServers/{authServerId}/scopes/{scopeId} method: put operationId: updateOAuth2Scope x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/authorizationServers/{authServerId}/scopes/{scopeId} method: delete operationId: deleteOAuth2Scope x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands method: get operationId: listBrands x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId} method: get operationId: getBrand x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId} method: put operationId: updateBrand x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/templates/email method: get operationId: listEmailTemplates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId}/templates/email/{templateName} method: get operationId: getEmailTemplate x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId}/templates/email/{templateName}/customizations method: get operationId: listEmailTemplateCustomizations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId}/templates/email/{templateName}/customizations method: post operationId: createEmailTemplateCustomization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/templates/email/{templateName}/customizations method: delete operationId: deleteEmailTemplateCustomizations x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/templates/email/{templateName}/customizations/{customizationId} method: get operationId: getEmailTemplateCustomization x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId}/templates/email/{templateName}/customizations/{customizationId} method: put operationId: updateEmailTemplateCustomization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/templates/email/{templateName}/customizations/{customizationId} method: delete operationId: deleteEmailTemplateCustomization x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/templates/email/{templateName}/customizations/{customizationId}/preview method: get operationId: getEmailTemplateCustomizationPreview x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId}/templates/email/{templateName}/default-content method: get operationId: getEmailTemplateDefaultContent x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId}/templates/email/{templateName}/default-content/preview method: get operationId: getEmailTemplateDefaultContentPreview x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId}/templates/email/{templateName}/test method: post operationId: sendTestEmail x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/themes method: get operationId: listBrandThemes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId}/themes/{themeId} method: get operationId: getBrandTheme x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/brands/{brandId}/themes/{themeId} method: put operationId: updateBrandTheme x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/themes/{themeId}/background-image method: post operationId: uploadBrandThemeBackgroundImage x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/themes/{themeId}/background-image method: delete operationId: deleteBrandThemeBackgroundImage x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/themes/{themeId}/favicon method: post operationId: uploadBrandThemeFavicon x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/themes/{themeId}/favicon method: delete operationId: deleteBrandThemeFavicon x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/themes/{themeId}/logo method: post operationId: uploadBrandThemeLogo x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/brands/{brandId}/themes/{themeId}/logo method: delete operationId: deleteBrandThemeLogo x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/domains method: get operationId: listDomains x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/domains method: post operationId: createDomain x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/domains/{domainId} method: get operationId: getDomain x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/domains/{domainId} method: delete operationId: deleteDomain x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/domains/{domainId}/certificate method: put operationId: createCertificate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/domains/{domainId}/verify method: post operationId: verifyDomain x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/eventHooks method: get operationId: listEventHooks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/eventHooks method: post operationId: createEventHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/eventHooks/{eventHookId} method: get operationId: getEventHook x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/eventHooks/{eventHookId} method: put operationId: updateEventHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/eventHooks/{eventHookId} method: delete operationId: deleteEventHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/eventHooks/{eventHookId}/lifecycle/activate method: post operationId: activateEventHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/eventHooks/{eventHookId}/lifecycle/deactivate method: post operationId: deactivateEventHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/eventHooks/{eventHookId}/lifecycle/verify method: post operationId: verifyEventHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/features method: get operationId: listFeatures x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/features/{featureId} method: get operationId: getFeature x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/features/{featureId}/dependencies method: get operationId: listFeatureDependencies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/features/{featureId}/dependents method: get operationId: listFeatureDependents x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/features/{featureId}/{lifecycle} method: post operationId: updateFeatureLifecycle x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups method: get operationId: listGroups x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/groups method: post operationId: createGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/rules method: get operationId: listGroupRules x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/groups/rules method: post operationId: createGroupRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/rules/{ruleId} method: get operationId: getGroupRule x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/groups/rules/{ruleId} method: put operationId: updateGroupRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/rules/{ruleId} method: delete operationId: deleteGroupRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/rules/{ruleId}/lifecycle/activate method: post operationId: activateGroupRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/rules/{ruleId}/lifecycle/deactivate method: post operationId: deactivateGroupRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId} method: get operationId: getGroup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/groups/{groupId} method: put operationId: updateGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId} method: delete operationId: deleteGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId}/apps method: get operationId: listAssignedApplicationsForGroup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/groups/{groupId}/roles method: get operationId: listGroupAssignedRoles x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/groups/{groupId}/roles method: post operationId: assignRoleToGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId}/roles/{roleId} method: get operationId: getRole x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/groups/{groupId}/roles/{roleId} method: delete operationId: removeRoleFromGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId}/roles/{roleId}/targets/catalog/apps method: get operationId: listApplicationTargetsForApplicationAdministratorRoleForGroup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/groups/{groupId}/roles/{roleId}/targets/catalog/apps/{appName} method: put operationId: addApplicationTargetToAdminRoleGivenToGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId}/roles/{roleId}/targets/catalog/apps/{appName} method: delete operationId: removeApplicationTargetFromApplicationAdministratorRoleGivenToGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId}/roles/{roleId}/targets/catalog/apps/{appName}/{applicationId} method: put operationId: addApplicationInstanceTargetToAppAdminRoleGivenToGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId}/roles/{roleId}/targets/catalog/apps/{appName}/{applicationId} method: delete operationId: removeApplicationTargetFromAdministratorRoleGivenToGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId}/roles/{roleId}/targets/groups method: get operationId: listGroupTargetsForGroupRole x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/groups/{groupId}/roles/{roleId}/targets/groups/{targetGroupId} method: put operationId: addGroupTargetToGroupAdministratorRoleForGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId}/roles/{roleId}/targets/groups/{targetGroupId} method: delete operationId: removeGroupTargetFromGroupAdministratorRoleGivenToGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId}/users method: get operationId: listGroupUsers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/groups/{groupId}/users/{userId} method: put operationId: addUserToGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/groups/{groupId}/users/{userId} method: delete operationId: removeUserFromGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps method: get operationId: listIdentityProviders x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/idps method: post operationId: createIdentityProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/credentials/keys method: get operationId: listIdentityProviderKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/idps/credentials/keys method: post operationId: createIdentityProviderKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/credentials/keys/{keyId} method: get operationId: getIdentityProviderKey x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/idps/credentials/keys/{keyId} method: delete operationId: deleteIdentityProviderKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId} method: get operationId: getIdentityProvider x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/idps/{idpId} method: put operationId: updateIdentityProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId} method: delete operationId: deleteIdentityProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId}/credentials/csrs method: get operationId: listCsrsForIdentityProvider x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/idps/{idpId}/credentials/csrs method: post operationId: generateCsrForIdentityProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId}/credentials/csrs/{csrId} method: get operationId: getCsrForIdentityProvider x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/idps/{idpId}/credentials/csrs/{csrId} method: delete operationId: revokeCsrForIdentityProvider x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/idps/{idpId}/credentials/csrs/{csrId}/lifecycle/publish method: post x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId}/credentials/keys method: get operationId: listIdentityProviderSigningKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/idps/{idpId}/credentials/keys/generate method: post operationId: generateIdentityProviderSigningKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId}/credentials/keys/{keyId} method: get operationId: getIdentityProviderSigningKey x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/idps/{idpId}/credentials/keys/{keyId}/clone method: post operationId: cloneIdentityProviderKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId}/lifecycle/activate method: post operationId: activateIdentityProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId}/lifecycle/deactivate method: post operationId: deactivateIdentityProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId}/users method: get operationId: listIdentityProviderApplicationUsers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/idps/{idpId}/users/{userId} method: get operationId: getIdentityProviderApplicationUser x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/idps/{idpId}/users/{userId} method: post operationId: linkUserToIdentityProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId}/users/{userId} method: delete operationId: unlinkUserFromIdentityProvider x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/idps/{idpId}/users/{userId}/credentials/tokens method: get operationId: listSocialAuthTokens x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/inlineHooks method: get operationId: listInlineHooks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/inlineHooks method: post operationId: createInlineHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/inlineHooks/{inlineHookId} method: get operationId: getInlineHook x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/inlineHooks/{inlineHookId} method: put operationId: updateInlineHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/inlineHooks/{inlineHookId} method: delete operationId: deleteInlineHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/inlineHooks/{inlineHookId}/execute method: post operationId: executeInlineHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/inlineHooks/{inlineHookId}/lifecycle/activate method: post operationId: activateInlineHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/inlineHooks/{inlineHookId}/lifecycle/deactivate method: post operationId: deactivateInlineHook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/logs method: get operationId: getLogs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/mappings method: get operationId: listProfileMappings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/mappings/{mappingId} method: get operationId: getProfileMapping x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/mappings/{mappingId} method: post operationId: updateProfileMapping x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/meta/schemas/apps/{appInstanceId}/default method: get operationId: getApplicationUserSchema x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/meta/schemas/apps/{appInstanceId}/default method: post operationId: updateApplicationUserProfile x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/meta/schemas/group/default method: get operationId: getGroupSchema x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/meta/schemas/group/default method: post operationId: updateGroupSchema x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/meta/schemas/user/linkedObjects method: get operationId: listLinkedObjectDefinitions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/meta/schemas/user/linkedObjects method: post operationId: addLinkedObjectDefinition x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/meta/schemas/user/linkedObjects/{linkedObjectName} method: get operationId: getLinkedObjectDefinition x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/meta/schemas/user/linkedObjects/{linkedObjectName} method: delete operationId: deleteLinkedObjectDefinition x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/meta/schemas/user/{schemaId} method: get operationId: getUserSchema x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/meta/schemas/user/{schemaId} method: post operationId: updateUserProfile x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/meta/types/user method: get operationId: listUserTypes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/meta/types/user method: post operationId: createUserType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/meta/types/user/{typeId} method: get operationId: getUserType x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/meta/types/user/{typeId} method: put operationId: replaceUserType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/meta/types/user/{typeId} method: post operationId: updateUserType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/meta/types/user/{typeId} method: delete operationId: deleteUserType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org method: get operationId: getOrgSettings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/org method: put operationId: updateOrgSetting x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org method: post operationId: partialUpdateOrgSetting x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org/contacts method: get operationId: getOrgContactTypes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/org/contacts/{contactType} method: get operationId: getOrgContactUser x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/org/contacts/{contactType} method: put operationId: updateOrgContactUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org/logo method: post operationId: updateOrgLogo x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org/preferences method: get operationId: getOrgPreferences x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/org/preferences/hideEndUserFooter method: post operationId: hideOktaUIFooter x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org/preferences/showEndUserFooter method: post operationId: showOktaUIFooter x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org/privacy/oktaCommunication method: get operationId: getOktaCommunicationSettings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/org/privacy/oktaCommunication/optIn method: post operationId: optInUsersToOktaCommunicationEmails x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org/privacy/oktaCommunication/optOut method: post operationId: optOutUsersFromOktaCommunicationEmails x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org/privacy/oktaSupport method: get operationId: getOrgOktaSupportSettings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/org/privacy/oktaSupport/extend method: post operationId: extendOktaSupport x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org/privacy/oktaSupport/grant method: post operationId: grantOktaSupport x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/org/privacy/oktaSupport/revoke method: post operationId: revokeOktaSupport x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/policies method: get operationId: listPolicies x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/policies method: post operationId: createPolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/policies/{policyId} method: get operationId: getPolicy x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/policies/{policyId} method: put operationId: updatePolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/policies/{policyId} method: delete operationId: deletePolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/policies/{policyId}/lifecycle/activate method: post operationId: activatePolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/policies/{policyId}/lifecycle/deactivate method: post operationId: deactivatePolicy x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/policies/{policyId}/rules method: get operationId: listPolicyRules x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/policies/{policyId}/rules method: post operationId: createPolicyRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/policies/{policyId}/rules/{ruleId} method: get operationId: getPolicyRule x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/policies/{policyId}/rules/{ruleId} method: put operationId: updatePolicyRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/policies/{policyId}/rules/{ruleId} method: delete operationId: deletePolicyRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/activate method: post operationId: activatePolicyRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate method: post operationId: deactivatePolicyRule x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/roles/{roleTypeOrRoleId}/subscriptions method: get operationId: listRoleSubscriptions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/roles/{roleTypeOrRoleId}/subscriptions/{notificationType} method: get operationId: getRoleSubscriptionByNotificationType x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/roles/{roleTypeOrRoleId}/subscriptions/{notificationType}/subscribe method: post operationId: subscribeRoleSubscriptionByNotificationType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/roles/{roleTypeOrRoleId}/subscriptions/{notificationType}/unsubscribe method: post operationId: unsubscribeRoleSubscriptionByNotificationType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/sessions method: post operationId: createSession x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/sessions/{sessionId} method: get operationId: getSession x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/sessions/{sessionId} method: delete operationId: endSession x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/sessions/{sessionId}/lifecycle/refresh method: post operationId: refreshSession x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/templates/sms method: get operationId: listSmsTemplates x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/templates/sms method: post operationId: createSmsTemplate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/templates/sms/{templateId} method: get operationId: getSmsTemplate x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/templates/sms/{templateId} method: put operationId: updateSmsTemplate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/templates/sms/{templateId} method: post operationId: partialUpdateSmsTemplate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/templates/sms/{templateId} method: delete operationId: deleteSmsTemplate x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/threats/configuration method: get operationId: getCurrentConfiguration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/threats/configuration method: post operationId: updateConfiguration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/trustedOrigins method: get operationId: listOrigins x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/trustedOrigins method: post operationId: createOrigin x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/trustedOrigins/{trustedOriginId} method: get operationId: getOrigin x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/trustedOrigins/{trustedOriginId} method: put operationId: updateOrigin x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/trustedOrigins/{trustedOriginId} method: delete operationId: deleteOrigin x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/trustedOrigins/{trustedOriginId}/lifecycle/activate method: post operationId: activateOrigin x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/trustedOrigins/{trustedOriginId}/lifecycle/deactivate method: post operationId: deactivateOrigin x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users method: get operationId: listUsers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users method: post operationId: createUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{associatedUserId}/linkedObjects/{primaryRelationshipName}/{primaryUserId} method: put operationId: setLinkedObjectForUser x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId} method: get operationId: getUser x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId} method: put operationId: updateUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId} method: post operationId: partialUpdateUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId} method: delete operationId: deactivateOrDeleteUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/appLinks method: get operationId: listAppLinks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/clients method: get operationId: listUserClients x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/clients/{clientId}/grants method: get operationId: listGrantsForUserAndClient x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/clients/{clientId}/grants method: delete operationId: revokeGrantsForUserAndClient x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/users/{userId}/clients/{clientId}/tokens method: get operationId: listRefreshTokensForUserAndClient x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/clients/{clientId}/tokens method: delete operationId: revokeTokensForUserAndClient x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/users/{userId}/clients/{clientId}/tokens/{tokenId} method: get operationId: getRefreshTokenForUserAndClient x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/clients/{clientId}/tokens/{tokenId} method: delete operationId: revokeTokenForUserAndClient x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/users/{userId}/credentials/change_password method: post operationId: changePassword x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/credentials/change_recovery_question method: post operationId: changeRecoveryQuestion x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/credentials/forgot_password method: post x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/factors method: get operationId: listFactors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/factors method: post operationId: enrollFactor x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/factors/catalog method: get operationId: listSupportedFactors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/factors/questions method: get operationId: listSupportedSecurityQuestions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/factors/{factorId} method: get operationId: getFactor x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/factors/{factorId} method: delete operationId: deleteFactor x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/factors/{factorId}/lifecycle/activate method: post operationId: activateFactor x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/factors/{factorId}/transactions/{transactionId} method: get operationId: getFactorTransactionStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/factors/{factorId}/verify method: post operationId: verifyFactor x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/grants method: get operationId: listUserGrants x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/grants method: delete operationId: revokeUserGrants x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/users/{userId}/grants/{grantId} method: get operationId: getUserGrant x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/grants/{grantId} method: delete operationId: revokeUserGrant x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/users/{userId}/groups method: get operationId: listUserGroups x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/idps method: get operationId: listUserIdentityProviders x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/lifecycle/activate method: post operationId: activateUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/lifecycle/deactivate method: post operationId: deactivateUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/lifecycle/expire_password?tempPassword=false method: post operationId: expirePassword x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/lifecycle/expire_password?tempPassword=true method: post operationId: expirePasswordAndGetTemporaryPassword x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/lifecycle/reactivate method: post operationId: reactivateUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/lifecycle/reset_factors method: post operationId: resetFactors x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/users/{userId}/lifecycle/reset_password method: post operationId: resetPassword x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/users/{userId}/lifecycle/suspend method: post operationId: suspendUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/lifecycle/unlock method: post operationId: unlockUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/lifecycle/unsuspend method: post operationId: unsuspendUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/linkedObjects/{relationshipName} method: get operationId: getLinkedObjectsForUser x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/linkedObjects/{relationshipName} method: delete operationId: removeLinkedObjectForUser x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/roles method: get operationId: listAssignedRolesForUser x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/roles method: post operationId: assignRoleToUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/roles/{roleId} method: get operationId: getUserRole x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/roles/{roleId} method: delete operationId: removeRoleFromUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps method: get operationId: listApplicationTargetsForApplicationAdministratorRoleForUser x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps method: put operationId: addAllAppsAsTargetToRole x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps/{appName} method: put operationId: addApplicationTargetToAdminRoleForUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps/{appName} method: delete operationId: removeApplicationTargetFromApplicationAdministratorRoleForUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps/{appName}/{applicationId} method: put operationId: addApplicationTargetToAppAdminRoleForUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps/{appName}/{applicationId} method: delete operationId: removeApplicationTargetFromAdministratorRoleForUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/roles/{roleId}/targets/groups method: get operationId: listGroupTargetsForRole x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/roles/{roleId}/targets/groups/{groupId} method: put operationId: addGroupTargetToRole x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/roles/{roleId}/targets/groups/{groupId} method: delete operationId: removeGroupTargetFromRole x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/sessions method: delete operationId: clearUserSessions x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/subscriptions method: get operationId: listUserSubscriptions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/subscriptions/{notificationType} method: get operationId: getUserSubscriptionByNotificationType x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/{userId}/subscriptions/{notificationType}/subscribe method: post operationId: subscribeUserSubscriptionByNotificationType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/{userId}/subscriptions/{notificationType}/unsubscribe method: post operationId: unsubscribeUserSubscriptionByNotificationType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/zones method: get operationId: listNetworkZones x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/zones method: post operationId: createNetworkZone x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/zones/{zoneId} method: get operationId: getNetworkZone x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/zones/{zoneId} method: put operationId: updateNetworkZone x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/zones/{zoneId} method: delete operationId: deleteNetworkZone x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/zones/{zoneId}/lifecycle/activate method: post operationId: activateNetworkZone x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/zones/{zoneId}/lifecycle/deactivate method: post operationId: deactivateNetworkZone x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required