generated: '2026-07-15' method: generated source: openapi/tanium-connect-api-openapi.yml, openapi/tanium-platform-rest-api-openapi.yml, openapi/tanium-threat-response-api-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 70 by_action_class: connected: 43 acting: 27 by_consequence: read: 43 write: 26 safety-critical: 1 human_in_the_loop_required: 1 operations: - path: /plugin/products/connect/v1/connections method: get operationId: listConnections x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/connect/v1/connections method: post operationId: createConnection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/connect/v1/connections/{connectionId} method: get operationId: getConnection x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/connect/v1/connections/{connectionId} method: put operationId: updateConnection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/connect/v1/connections/{connectionId} method: delete operationId: deleteConnection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/connect/v1/connections/{connectionId}/run method: post operationId: runConnection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/connect/v1/connections/{connectionId}/enable method: put operationId: enableConnection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/connect/v1/connections/{connectionId}/disable method: put operationId: disableConnection x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /plugin/products/connect/v1/sources method: get operationId: listSources x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/connect/v1/sources/{sourceId} method: get operationId: getSource x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/connect/v1/destinations method: get operationId: listDestinations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/connect/v1/destinations method: post operationId: createDestination x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/connect/v1/destinations/{destinationId} method: get operationId: getDestination x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/connect/v1/destinations/{destinationId} method: put operationId: updateDestination x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/connect/v1/destinations/{destinationId} method: delete operationId: deleteDestination x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/connect/v1/schedules method: get operationId: listSchedules x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/connect/v1/schedules/{scheduleId} method: get operationId: getSchedule x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/connect/v1/status method: get operationId: getConnectStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/connect/v1/logs method: get operationId: listConnectionLogs x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/session/login method: post operationId: createSession x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/api_tokens method: post operationId: createApiToken x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/questions method: post operationId: createQuestion x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/questions/{id} method: get operationId: getQuestion x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/result_data/question/{id} method: get operationId: getQuestionResults x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/parse_question method: post operationId: parseQuestion x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/saved_questions method: get operationId: listSavedQuestions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/saved_questions/by-name/{name} method: get operationId: getSavedQuestionByName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/result_data/saved_question/{id} method: get operationId: getSavedQuestionResults x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/saved_actions method: post operationId: createSavedAction x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /api/v2/action_groups/by-name/{name} method: get operationId: getActionGroupByName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/packages/by-name/{name} method: get operationId: getPackageByName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/packages method: get operationId: listPackages x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/sensors/by-name/{name} method: get operationId: getSensorByName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/sensors method: get operationId: listSensors x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/groups/by-name/{name} method: get operationId: getGroupByName x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /api/v2/groups method: get operationId: listGroups x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/status method: get operationId: getThreatResponseStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/alerts method: get operationId: listAlerts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/alerts/{alertId} method: get operationId: getAlert x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/alerts/{alertId} method: put operationId: updateAlertState x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/conns method: get operationId: listConnections x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/conns/connect method: post operationId: createConnection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/conns/{connectionId} method: get operationId: getConnection x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/conns/close/{connectionId} method: post operationId: closeConnection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/conns/delete/{connectionId} method: delete operationId: deleteConnection x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/conns/{connectionId}/snapshot method: post operationId: createSnapshot x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/snapshot method: get operationId: listSnapshots x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/snapshot method: delete operationId: deleteSnapshots x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/snapshot/{snapshotId} method: delete operationId: deleteLocalSnapshot x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/conns/{connectionId}/views/{eventType}/events method: get operationId: listEvents x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/conns/{connectionId}/views/{eventType}/eventsCount method: get operationId: getEventsSummary x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/conns/{connectionId}/processevents/{processTableId}/{eventType} method: get operationId: getProcessEvents x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/conns/{connectionId}/processtrees/{processTableId} method: get operationId: getProcessTree x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/filedownload method: get operationId: listFileDownloads x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/filedownload/{fileId} method: get operationId: getFileDownload x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/filedownload/{fileId} method: delete operationId: deleteFileDownload x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/filedownload/data/{fileId} method: get operationId: downloadFileContent x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/conns/{connectionId}/file method: post operationId: requestFileFromEndpoint x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/intels method: post operationId: uploadIntelDocument x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/intels method: get operationId: listIntelDocuments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/intels/{intelDocId} method: get operationId: getIntelDocument x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/intels/{intelDocId}/labels method: get operationId: listIntelDocumentLabels x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/intels/{intelDocId}/labels method: post operationId: addLabelToIntelDocument x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/labels method: get operationId: listLabels x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/labels/{labelId} method: get operationId: getLabel x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/evidence method: get operationId: listEvidence x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/evidence method: post operationId: createEvidence x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/evidence/{evidenceId} method: get operationId: getEvidence x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /plugin/products/threat-response/api/v1/evidence/{evidenceId} method: delete operationId: deleteEvidence x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /plugin/products/threat-response/api/v1/evidence/properties method: get operationId: getEvidenceProperties x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none