generated: '2026-07-15' method: generated source: openapi/ory-hydra-openapi.json, openapi/ory-keto-openapi.json, openapi/ory-kratos-openapi.json, openapi/ory-oathkeeper-openapi.json description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 128 by_action_class: connected: 71 acting: 57 by_consequence: read: 71 write: 47 safety-critical: 6 physical: 4 human_in_the_loop_required: 6 operations: - path: /.well-known/jwks.json method: get operationId: discoverJsonWebKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /.well-known/openid-configuration method: get operationId: discoverOidcConfiguration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/clients method: get operationId: listOAuth2Clients x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/clients method: post operationId: createOAuth2Client x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/clients/{id} method: delete operationId: deleteOAuth2Client x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/clients/{id} method: get operationId: getOAuth2Client x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/clients/{id} method: patch operationId: patchOAuth2Client x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/clients/{id} method: put operationId: setOAuth2Client x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/clients/{id}/lifespans method: put operationId: setOAuth2ClientLifespans x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/keys/{set} method: delete operationId: deleteJsonWebKeySet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/keys/{set} method: get operationId: getJsonWebKeySet x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/keys/{set} method: post operationId: createJsonWebKeySet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/keys/{set} method: put operationId: setJsonWebKeySet x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/keys/{set}/{kid} method: delete operationId: deleteJsonWebKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/keys/{set}/{kid} method: get operationId: getJsonWebKey x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/keys/{set}/{kid} method: put operationId: setJsonWebKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/oauth2/auth/requests/consent method: get operationId: getOAuth2ConsentRequest x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/oauth2/auth/requests/consent/accept method: put operationId: acceptOAuth2ConsentRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/oauth2/auth/requests/consent/reject method: put operationId: rejectOAuth2ConsentRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/oauth2/auth/requests/device/accept method: put operationId: acceptUserCodeRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/oauth2/auth/requests/login method: get operationId: getOAuth2LoginRequest x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/oauth2/auth/requests/login/accept method: put operationId: acceptOAuth2LoginRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/oauth2/auth/requests/login/reject method: put operationId: rejectOAuth2LoginRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/oauth2/auth/requests/logout method: get operationId: getOAuth2LogoutRequest x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/oauth2/auth/requests/logout/accept method: put operationId: acceptOAuth2LogoutRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/oauth2/auth/requests/logout/reject method: put operationId: rejectOAuth2LogoutRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/oauth2/auth/sessions/consent method: delete operationId: revokeOAuth2ConsentSessions x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /admin/oauth2/auth/sessions/consent method: get operationId: listOAuth2ConsentSessions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/oauth2/auth/sessions/login method: delete operationId: revokeOAuth2LoginSessions x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /admin/oauth2/introspect method: post operationId: introspectOAuth2Token x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/oauth2/tokens method: delete operationId: deleteOAuth2Token x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/trust/grants/jwt-bearer/issuers method: get operationId: listTrustedOAuth2JwtGrantIssuers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/trust/grants/jwt-bearer/issuers method: post operationId: trustOAuth2JwtGrantIssuer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/trust/grants/jwt-bearer/issuers/{id} method: delete operationId: deleteTrustedOAuth2JwtGrantIssuer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/trust/grants/jwt-bearer/issuers/{id} method: get operationId: getTrustedOAuth2JwtGrantIssuer x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /credentials method: post operationId: createVerifiableCredential x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /health/alive method: get operationId: isAlive x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /health/ready method: get operationId: isReady x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /oauth2/auth method: get operationId: oAuth2Authorize x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /oauth2/device/auth method: post operationId: oAuth2DeviceFlow x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /oauth2/device/verify method: get operationId: performOAuth2DeviceVerificationFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /oauth2/register method: post operationId: createOidcDynamicClient x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /oauth2/register/{id} method: delete operationId: deleteOidcDynamicClient x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /oauth2/register/{id} method: get operationId: getOidcDynamicClient x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /oauth2/register/{id} method: put operationId: setOidcDynamicClient x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /oauth2/revoke method: post operationId: revokeOAuth2Token x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /oauth2/sessions/logout method: get operationId: revokeOidcSession x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /oauth2/token method: post operationId: oauth2TokenExchange x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /userinfo method: get operationId: getOidcUserInfo x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /version method: get operationId: getVersion x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/relation-tuples method: delete operationId: deleteRelationships x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/relation-tuples method: patch operationId: patchRelationships x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/relation-tuples method: put operationId: createRelationship x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /health/alive method: get operationId: isAlive x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /health/ready method: get operationId: isReady x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /namespaces method: get operationId: listRelationshipNamespaces x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /opl/syntax/check method: post operationId: checkOplSyntax x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /relation-tuples method: get operationId: getRelationships x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /relation-tuples/batch/check method: post operationId: batchCheckPermission x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /relation-tuples/check method: get operationId: checkPermissionOrError x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /relation-tuples/check method: post operationId: postCheckPermissionOrError x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /relation-tuples/check/openapi method: get operationId: checkPermission x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /relation-tuples/check/openapi method: post operationId: postCheckPermission x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /relation-tuples/expand method: get operationId: expandPermissions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /version method: get operationId: getVersion x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /.well-known/ory/webauthn.js method: get operationId: getWebAuthnJavaScript x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/courier/messages method: get operationId: listCourierMessages x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/courier/messages/{id} method: get operationId: getCourierMessage x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/identities method: get operationId: listIdentities x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/identities method: patch operationId: batchPatchIdentities x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/identities method: post operationId: createIdentity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/identities/by/external/{externalID} method: get operationId: getIdentityByExternalID x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/identities/{id} method: delete operationId: deleteIdentity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/identities/{id} method: get operationId: getIdentity x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/identities/{id} method: patch operationId: patchIdentity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/identities/{id} method: put operationId: updateIdentity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/identities/{id}/credentials/{type} method: delete operationId: deleteIdentityCredentials x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/identities/{id}/sessions method: delete operationId: deleteIdentitySessions x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/identities/{id}/sessions method: get operationId: listIdentitySessions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/recovery/code method: post operationId: createRecoveryCodeForIdentity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/recovery/link method: post operationId: createRecoveryLinkForIdentity x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /admin/sessions method: get operationId: listSessions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/sessions/{id} method: delete operationId: disableSession x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /admin/sessions/{id} method: get operationId: getSession x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /admin/sessions/{id}/extend method: patch operationId: extendSession x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /health/alive method: get operationId: isAlive x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /health/ready method: get operationId: isReady x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /schemas method: get operationId: listIdentitySchemas x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /schemas/{id} method: get operationId: getIdentitySchema x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/errors method: get operationId: getFlowError x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/fed-cm/parameters method: get operationId: createFedcmFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/fed-cm/token method: post operationId: updateFedcmFlow x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /self-service/login method: post operationId: updateLoginFlow x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /self-service/login/api method: get operationId: createNativeLoginFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/login/browser method: get operationId: createBrowserLoginFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/login/flows method: get operationId: getLoginFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/logout method: get operationId: updateLogoutFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/logout/api method: delete operationId: performNativeLogout x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /self-service/logout/browser method: get operationId: createBrowserLogoutFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/recovery method: post operationId: updateRecoveryFlow x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /self-service/recovery/api method: get operationId: createNativeRecoveryFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/recovery/browser method: get operationId: createBrowserRecoveryFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/recovery/flows method: get operationId: getRecoveryFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/registration method: post operationId: updateRegistrationFlow x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /self-service/registration/api method: get operationId: createNativeRegistrationFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/registration/browser method: get operationId: createBrowserRegistrationFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/registration/flows method: get operationId: getRegistrationFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/settings method: post operationId: updateSettingsFlow x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /self-service/settings/api method: get operationId: createNativeSettingsFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/settings/browser method: get operationId: createBrowserSettingsFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/settings/flows method: get operationId: getSettingsFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/verification method: post operationId: updateVerificationFlow x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /self-service/verification/api method: get operationId: createNativeVerificationFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/verification/browser method: get operationId: createBrowserVerificationFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /self-service/verification/flows method: get operationId: getVerificationFlow x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sessions method: delete operationId: disableMyOtherSessions x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sessions method: get operationId: listMySessions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sessions/token-exchange method: get operationId: exchangeSessionToken x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sessions/whoami method: get operationId: toSession x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sessions/{id} method: delete operationId: disableMySession x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /version method: get operationId: getVersion x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /.well-known/jwks.json method: get operationId: getWellKnownJSONWebKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /decisions method: get operationId: decisions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /health/alive method: get operationId: isAlive x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /health/ready method: get operationId: isReady x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /rules method: get operationId: listRules x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /rules/{id} method: get operationId: getRule x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /version method: get operationId: getVersion x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none