generated: '2026-08-04' method: generated source: openapi/onpay-api-openapi.json description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 58 by_action_class: connected: 30 acting: 28 by_consequence: read: 30 write: 28 human_in_the_loop_required: 0 operations: - path: /employees method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /employees method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id} method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /employees/{employee_id} method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/deductions method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Controller - Employee - Manager - Owner token: max-ttl: 3600 audit: none - path: /employees/{employee_id}/deductions/{deduction_id} method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/deductions/{deduction_id} method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/deductions/{deduction_id}/schedule method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /employees/{employee_id}/deductions/{deduction_id}/schedule method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/bank-accounts method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /employees/{employee_id}/bank-accounts method: put x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/wages method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /employees/{employee_id}/wages method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/wages/schedule method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /employees/{employee_id}/wages/schedule method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/leave method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /employees/{employee_id}/leave method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/tax-fields method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /employees/{employee_id}/tax-fields method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/tax-fields/worksite method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/termination method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Controller - Manager - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/{employee_id}/rehire method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Controller - Manager - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employees/recent-notes-and-comments method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Controller - Manager - Owner token: max-ttl: 3600 audit: none - path: /company method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/pay-schedules method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/deductions method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/deductions method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/deductions/{deduction_id} method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/deductions/{deduction_id} method: delete x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/deduction-groupings method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/deduction-groupings method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/deduction-groupings/{id} method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/worksites method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Controller - Manager - Owner token: max-ttl: 3600 audit: none - path: /company/worksites method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/worksites/{id} method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Controller - Manager - Owner token: max-ttl: 3600 audit: none - path: /company/worksites/{id} method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/locations method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/locations method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/locations/{id} method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/locations/{id} method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/departments method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/departments method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/departments/{id} method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/departments/{id} method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/positions method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/positions method: post x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/positions/{id} method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/positions/{id} method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/state-tax-fields/{fips} method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/state-tax-fields/{fips} method: patch x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/unprocessed-hours method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /company/unprocessed-hours method: put x-agentic-access: action-class: acting consequence: write subject: required scope: - Approver - Owner audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /company/pay-schedule-dates method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Controller - Manager - Owner token: max-ttl: 3600 audit: none - path: /user method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Controller - Employee - Manager - Owner token: max-ttl: 3600 audit: none - path: /reports/listing method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /reports/pagination/listing method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /reports/approved-pay-runs method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none - path: /reports/retirement-summary method: get x-agentic-access: action-class: connected consequence: read subject: optional scope: - Approver - Owner token: max-ttl: 3600 audit: none