generated: '2026-07-15' method: generated source: openapi/roku-external-control-protocol.yaml, openapi/roku-nabu-cloud.yaml, openapi/roku-pay-web-services.yaml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 95 by_action_class: connected: 56 acting: 39 by_consequence: read: 56 write: 35 physical: 2 safety-critical: 2 human_in_the_loop_required: 2 operations: - path: / method: get operationId: getDeviceRoot x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/device-info method: get operationId: queryDeviceInfo x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/apps method: get operationId: queryApps x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/active-app method: get operationId: queryActiveApp x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/icon/{appId} method: get operationId: queryAppIcon x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/media-player method: get operationId: queryMediaPlayer x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /launch/{appId} method: post operationId: launchApp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /install/{appId} method: post operationId: installApp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /exit-app/{appId} method: post operationId: exitApp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /keypress/{key} method: post operationId: keyPress x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /keydown/{key} method: post operationId: keyDown x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /keyup/{key} method: post operationId: keyUp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /input method: post operationId: sendInput x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /search/browse method: post operationId: searchBrowse x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /query/tv-channels method: get operationId: queryTvChannels x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/tv-active-channel method: get operationId: queryTvActiveChannel x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/chanperf method: get operationId: queryChanPerf x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/r2d2-bitmaps method: get operationId: queryR2d2Bitmaps x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/sgnodes/all method: get operationId: querySgNodesAll x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/registry/{appId} method: get operationId: queryRegistry x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /query/app-state/{appId} method: get operationId: queryAppState x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/-/livez method: get operationId: healthz-healthz x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/-/readyz method: get operationId: healthz-readyz x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/me method: get operationId: users-get_me x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/me/organisations method: get operationId: users-get_my_organisation x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/me/projects method: get operationId: users-get_my_projects x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/me/groups method: get operationId: users-get_my_group x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/me/personal_access_tokens method: get operationId: personal-access-tokens-list_personal_access_tokens x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/me/personal_access_tokens method: post operationId: personal-access-tokens-create_personal_access_token x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/users/me/personal_access_tokens/{token_id} method: delete operationId: personal-access-tokens-revoke_personal_access_token x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/users/me/personal_access_tokens/scopes method: get operationId: personal-access-tokens-get_personal_access_token_scopes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/users/me/personal_access_tokens/{token_id}/refresh method: patch operationId: personal-access-tokens-refresh_personal_access_token x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/builds method: get operationId: builds-list_builds x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/builds/{build_id} method: get operationId: builds-get_build x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisation-roles method: get operationId: organisation-roles-list_organisation_roles x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisation-roles/{role_id} method: get operationId: organisation-roles-get_organisation_role x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations method: get operationId: organisations-list_organisations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id} method: get operationId: organisations-get_organisation x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/members method: get operationId: organisations-list_organisation_members x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/members/{user_id} method: get operationId: organisations-get_organisation_member x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/regions method: get operationId: organisations-list_organisation_regions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/regions/{region_id} method: get operationId: organisations-get_organisation_region x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/roles/projects method: get operationId: organisations-list_project_roles x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/roles/projects/{role_id} method: get operationId: organisations-get_project_role x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/roles/groups method: get operationId: organisations-list_group_roles x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/roles/groups/{role_id} method: get operationId: organisations-get_group_role x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/groups method: get operationId: groups-list_group x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/groups method: post operationId: groups-create_group x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/groups/{group_id} method: get operationId: groups-get_group x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/groups/{group_id} method: patch operationId: groups-update_group x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/groups/{group_id} method: delete operationId: groups-delete_group x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/groups/{group_id}/members method: get operationId: groups-list_group_members x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/groups/{group_id}/members method: post operationId: groups-add_group_member x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/groups/{group_id}/members/{user_id} method: get operationId: groups-get_group_member x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/groups/{group_id}/members/{user_id} method: patch operationId: groups-update_group_member x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/groups/{group_id}/members/{user_id} method: delete operationId: groups-remove_group_member x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects method: get operationId: projects-list_projects x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects method: post operationId: projects-create_project x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id} method: get operationId: projects-get_project x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id} method: patch operationId: projects-update_project x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id} method: delete operationId: projects-delete_project x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/groups method: get operationId: projects-list_project_groups x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/groups method: post operationId: projects-add_project_group x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/groups/{group_id} method: get operationId: projects-get_project_group x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/groups/{group_id} method: patch operationId: projects-update_project_group x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/groups/{group_id} method: delete operationId: projects-remove_project_group x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/members method: get operationId: projects-list_project_members x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/members method: post operationId: projects-add_project_member x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/members/{user_id} method: get operationId: projects-get_project_member x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/members/{user_id} method: patch operationId: projects-update_project_member x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/members/{user_id} method: delete operationId: projects-remove_project_member x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/serviceaccounts/login method: post operationId: serviceaccounts-login_token x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices method: get operationId: devices-list_devices x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices method: post operationId: devices-create_device x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id} method: get operationId: devices-get_device x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id} method: patch operationId: devices-update_device x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id} method: delete operationId: devices-delete_device x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id}/start method: post operationId: devices-start_device x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id}/stop method: post operationId: devices-stop_device x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id}/runs method: get operationId: devices-get_device_runs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id}/logs/{instance_id} method: get operationId: devices-read_logs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id}/snapshots method: get operationId: snapshots-list_snapshots x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id}/snapshots method: post operationId: snapshots-create_snapshot x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id}/snapshots/{snapshot_id} method: get operationId: snapshots-get_snapshot x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id}/snapshots/{snapshot_id} method: patch operationId: snapshots-update_snapshot x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v1/organisations/{organisation_id}/projects/{project_id}/devices/{device_id}/snapshots/{snapshot_id} method: delete operationId: snapshots-delete_snapshot x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /asyncapi method: get operationId: asyncapi-serve_asyncapi_schema x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /asyncapi.json method: get operationId: asyncapi-download_app_json_schema x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /asyncapi.yaml method: get operationId: asyncapi-download_app_yaml_schema x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /validate-transaction/{partnerAPIKey}/{transactionId} method: get operationId: validateTransaction x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /validate-refund/{partnerAPIKey}/{refundId} method: get operationId: validateRefund x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /cancel-subscription method: post operationId: cancelSubscription x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /refund-subscription method: post operationId: refundSubscription x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /update-bill-cycle method: post operationId: updateBillCycle x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /issue-service-credit method: post operationId: issueServiceCredit x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required