generated: '2026-07-15' method: generated source: openapi/salsa-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 42 by_action_class: acting: 25 connected: 17 by_consequence: write: 22 read: 17 physical: 3 human_in_the_loop_required: 0 operations: - path: /employers method: post operationId: createEmployer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers method: get operationId: listEmployers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId} method: get operationId: getEmployer x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId} method: patch operationId: updateEmployer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId} method: delete operationId: deleteEmployer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/pay-types method: get operationId: listPayTypes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/pay-types method: post operationId: createPayType x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/bank-accounts method: get operationId: listEmployerBankAccounts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/bank-accounts method: post operationId: createEmployerBankAccount x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/workers method: post operationId: createWorker x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/workers method: get operationId: listWorkers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/workers/{workerId} method: get operationId: getWorker x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/workers/{workerId} method: patch operationId: updateWorker x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/workers/{workerId} method: delete operationId: deleteWorker x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/workers/{workerId}/contracts method: get operationId: listWorkerContracts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/workers/{workerId}/contracts method: post operationId: createWorkerContract x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/workers/{workerId}/bank-accounts method: get operationId: listWorkerBankAccounts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/workers/{workerId}/bank-accounts method: post operationId: createWorkerBankAccount x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/worker-pay-groups method: get operationId: listWorkerPayGroups x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/worker-pay-groups method: post operationId: createWorkerPayGroup x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/work-weeks method: get operationId: listWorkWeeks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/work-weeks method: post operationId: createWorkWeek x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/payroll-runs method: post operationId: createPayrollRun x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/payroll-runs method: get operationId: listPayrollRuns x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/payroll-runs/{payrollRunId} method: get operationId: getPayrollRun x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/payroll-runs/{payrollRunId} method: delete operationId: deletePayrollRun x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/payroll-runs/{payrollRunId}/preview method: post operationId: previewPayrollRun x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/payroll-runs/{payrollRunId}/confirm method: post operationId: confirmPayrollRun x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/reports/payroll-journal method: get operationId: getPayrollJournalReport x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/workers/{workerId}/payments method: post operationId: createWorkerPayment x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/workers/{workerId}/payments method: get operationId: listWorkerPayments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /employers/{employerId}/workers/{workerId}/payments/{paymentId}/confirm method: post operationId: confirmWorkerPayment x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/workers/{workerId}/payments/{paymentId}/deductions method: post operationId: createPaymentDeduction x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /user-tokens method: post operationId: createUserToken x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/hosted-onboardings method: post operationId: createHostedEmployerOnboarding x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/mock-onboard method: post operationId: mockOnboardEmployer x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/workers/mock-onboard method: post operationId: mockOnboardWorker x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /employers/{employerId}/taxes-setup method: get operationId: getEmployerTaxSetup x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /webhook-endpoints method: post operationId: createWebhookEndpoint x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /webhook-endpoints method: get operationId: listWebhookEndpoints x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /webhook-endpoints/{webhookEndpointId} method: get operationId: getWebhookEndpoint x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /webhook-endpoints/{webhookEndpointId} method: patch operationId: updateWebhookEndpoint x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required