generated: '2026-07-15' method: generated source: openapi/passbolt-openapi.yaml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 90 by_action_class: connected: 39 acting: 51 by_consequence: read: 39 write: 51 human_in_the_loop_required: 0 operations: - path: /auth/is-authenticated.json method: get operationId: viewAuthIsAuthenticated x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/jwt/jwks.json method: get operationId: viewAuthJwtJwks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/jwt/login.json method: post operationId: authJwtLogin x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/jwt/logout.json method: post operationId: authJwtLogout x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/jwt/refresh.json method: post operationId: authJwtRefresh x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/jwt/rsa.json method: get operationId: viewAuthJwtRsa x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/login.json method: post operationId: authLogin x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/logout.json method: post operationId: authLogout x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /auth/verify.json method: get operationId: viewAuthVerify x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/verify.json method: post operationId: checkAuthVerify x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /avatars/view/{avatarId}/{avatarFormat} method: get operationId: viewAvatar x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /comments/{commentId}.json method: put operationId: updateComment x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /comments/{commentId}.json method: delete operationId: deleteComment x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /comments/resource/{resourceId}.json method: get operationId: indexComments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /comments/resource/{resourceId}.json method: post operationId: addComment x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /directorysync/synchronize/dry-run.json method: get operationId: simulateSync x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /directorysync/synchronize.json method: post operationId: runSync x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /favorite/{favoriteId}.json method: delete operationId: deleteFavorite x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /favorite/{foreignModel}/{foreignId}.json method: post operationId: addFavorite x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /folders.json method: get operationId: indexFolders x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /folders.json method: post operationId: addFolder x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /folders/{folderId}.json method: get operationId: viewFolder x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /folders/{folderId}.json method: put operationId: updateFolder x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /folders/{folderId}.json method: delete operationId: deleteFolder x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /gpgkeys.json method: get operationId: indexGpgkeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /gpgkeys/{gpgkeyId}.json method: get operationId: viewGpgkey x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /groups.json method: get operationId: indexGroups x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /groups.json method: post operationId: addGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /groups/{groupId}.json method: get operationId: viewGroup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /groups/{groupId}.json method: put operationId: updateGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /groups/{groupId}.json method: delete operationId: deleteGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /groups/{groupId}/dry-run.json method: put operationId: dryRunUpdateGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /groups/{groupId}/dry-run.json method: delete operationId: dryRunDeleteGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /healthcheck.json method: get operationId: viewHealthcheck x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /healthcheck/status.json method: get operationId: viewHealthcheckStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/keys.json method: get operationId: indexMetadataKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/keys.json method: post operationId: addMetadataKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/keys/{metadataKeyId}.json method: put operationId: updateMetadataKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/keys/{metadataKeyId}.json method: delete operationId: deleteMetadataKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/keys/privates.json method: post operationId: addMetadataPrivateKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/keys/private/{metadataPrivateKeyId}.json method: put operationId: updateMetadataPrivateKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/keys/settings.json method: get operationId: indexMetadataKeysSettings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/keys/settings.json method: post operationId: updateMetadataKeysSettings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/types/settings.json method: get operationId: viewMetadataTypesSettings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/types/settings.json method: post operationId: upgradeMetadataTypesSettings x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/rotate-key/folders.json method: get operationId: viewMetadataRotateKeyFolders x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/rotate-key/folders.json method: post operationId: rotateMetadataExpiredKeysFolders x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/rotate-key/resources.json method: get operationId: viewMetadataRotateKeyResources x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/rotate-key/resources.json method: post operationId: rotateMetadataExpiredKeys x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/session-keys.json method: get operationId: viewMetadataSessionKeys x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/session-keys.json method: post operationId: addMetadataSessionKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/session-key/{sessionKeyId}.json method: post operationId: updateMetadataSessionKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/session-key/{sessionKeyId}.json method: delete operationId: deleteSessionKey x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/rotate-key/tags.json method: get operationId: viewMetadataRotateKeyTags x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/rotate-key/tags.json method: post operationId: rotateMetadataKeysTags x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/upgrade/folders.json method: get operationId: viewMetadataUpgradeFolders x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/upgrade/folders.json method: post operationId: upgradeMetadataFolders x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/upgrade/resources.json method: get operationId: viewMetadataUpgradeResources x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/upgrade/resources.json method: post operationId: upgradeMetadataResources x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /metadata/upgrade/tags.json method: get operationId: viewMetadataUpgradeTags x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /metadata/upgrade/tags.json method: post operationId: processeMetadataUpgradeTags x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /mfa/verify/{mfaProviderName}.json method: get operationId: mfaVerifyCheck x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /mfa/verify/{mfaProviderName}.json method: post operationId: mfaVerifyAttempt x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /mfa/verify/error.json method: get operationId: mfaVerifyError x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /move/{foreignModel}/{foreignId}.json method: put operationId: moveElement x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /permissions/resource/{resourceId}.json method: get operationId: indexPermissionsResource x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /resources.json method: get operationId: indexResources x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /resources.json method: post operationId: addResource x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /resources/{resourceId}.json method: get operationId: viewResource x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /resources/{resourceId}.json method: put operationId: updateResource x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /resources/{resourceId}.json method: delete operationId: deleteResource x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /resource-types.json method: get operationId: resourceTypesIndex x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /resource-types/{resourceTypeId}.json method: get operationId: viewResourceType x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /resource-types/{resourceTypeId}.json method: delete operationId: deleteResourceType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /resource-types/{resourceTypeId}.json method: put operationId: updateResourceType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /roles.json method: get operationId: indexRoles x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /secrets/resource/{resourceId}.json method: get operationId: viewSecret x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /settings.json method: get operationId: indexSettings x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /share/{foreignModel}/{foreignId}.json method: put operationId: updateShare x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /share/search-aros.json method: get operationId: indexShareAros x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /share/simulate/{foreignModel}/{foreignId}.json method: post operationId: updateShareDryRun x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tags.json method: get operationId: indexTags x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /tags/{resourceOrTagId}.json method: put operationId: updateTag x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /tags/{resourceOrTagId}.json method: post operationId: addTagsResource x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users.json method: get operationId: indexUsers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /users.json method: post operationId: addUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userId}.json method: get operationId: viewUser x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /users/{userId}.json method: put operationId: updateUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userId}.json method: delete operationId: deleteUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userId}/dry-run.json method: delete operationId: dryRunDeleteUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required