generated: '2026-07-15' method: generated source: openapi/workday-extend-custom-objects-openapi.yml, openapi/workday-extend-graph-api-openapi.yml, openapi/workday-extend-orchestration-openapi.yml, openapi/workday-extend-rest-api-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 44 by_action_class: connected: 21 acting: 23 by_consequence: read: 21 write: 22 physical: 1 human_in_the_loop_required: 0 operations: - path: /customObjectDefinitions method: get operationId: listCustomObjectDefinitions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - customObjects:manage - path: /customObjectDefinitions method: post operationId: createCustomObjectDefinition x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - customObjects:manage - path: /customObjectDefinitions/{definitionId} method: get operationId: getCustomObjectDefinition x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - customObjects:manage - path: /customObjectDefinitions/{definitionId} method: patch operationId: updateCustomObjectDefinition x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - customObjects:manage - path: /customObjectDefinitions/{definitionId} method: delete operationId: deleteCustomObjectDefinition x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - customObjects:manage - path: /customObjectDefinitions/{definitionId}/fields method: get operationId: listCustomObjectFields x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - customObjects:manage - path: /customObjectDefinitions/{definitionId}/fields method: post operationId: addCustomObjectField x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - customObjects:manage - path: /workers/{workerId}/customObjects/{customObjectName} method: get operationId: getWorkerCustomObject x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - customObjects:manage - path: /workers/{workerId}/customObjects/{customObjectName} method: put operationId: updateWorkerCustomObject x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - customObjects:manage - path: /workers/{workerId}/customObjects/{customObjectName} method: delete operationId: deleteWorkerCustomObject x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - customObjects:manage - path: /organizations/{organizationId}/customObjects/{customObjectName} method: get operationId: getOrganizationCustomObject x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - customObjects:manage - path: /organizations/{organizationId}/customObjects/{customObjectName} method: put operationId: updateOrganizationCustomObject x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - customObjects:manage - path: /query method: post operationId: executeGraphQuery x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - graph:read - path: /wql method: post operationId: executeWqlQuery x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - graph:read - path: /schema method: get operationId: getSchema x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - graph:read - path: /schema/types method: get operationId: listSchemaTypes x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - graph:read - path: /schema/types/{typeName} method: get operationId: getSchemaType x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - graph:read - path: /orchestrations method: get operationId: listOrchestrations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - orchestrate:orchestrations - path: /orchestrations method: post operationId: createOrchestration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId} method: get operationId: getOrchestration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId} method: patch operationId: updateOrchestration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId} method: delete operationId: deleteOrchestration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId}/activate method: post operationId: activateOrchestration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId}/deactivate method: post operationId: deactivateOrchestration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId}/executions method: get operationId: listOrchestrationExecutions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId}/executions method: post operationId: launchOrchestration x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId}/executions/{executionId} method: get operationId: getOrchestrationExecution x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId}/executions/{executionId}/cancel method: post operationId: cancelOrchestrationExecution x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId}/steps method: get operationId: listOrchestrationSteps x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId}/triggers method: get operationId: listOrchestrationTriggers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - orchestrate:orchestrations - path: /orchestrations/{orchestrationId}/triggers method: post operationId: createOrchestrationTrigger x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - orchestrate:orchestrations - path: /apps method: get operationId: listApps x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - extend:apps - path: /apps method: post operationId: createApp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - extend:apps - path: /apps/{appId} method: get operationId: getApp x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - extend:apps - path: /apps/{appId} method: patch operationId: updateApp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - extend:apps - path: /apps/{appId} method: delete operationId: deleteApp x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - extend:apps - path: /apps/{appId}/versions method: get operationId: listAppVersions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - extend:apps - path: /apps/{appId}/versions method: post operationId: createAppVersion x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - extend:apps - path: /apps/{appId}/versions/{versionId} method: get operationId: getAppVersion x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - extend:apps - path: /apps/{appId}/configurations method: get operationId: listAppConfigurations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - extend:apps - path: /apps/{appId}/configurations method: put operationId: updateAppConfigurations x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - extend:apps - path: /apps/{appId}/deployments method: get operationId: listAppDeployments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - extend:apps - path: /apps/{appId}/deployments method: post operationId: deployApp x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required scope: - extend:apps - path: /apps/{appId}/deployments/{deploymentId} method: get operationId: getAppDeployment x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none scope: - extend:apps