generated: '2026-07-15' method: generated source: openapi/workos-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 172 by_action_class: acting: 98 connected: 74 by_consequence: safety-critical: 98 read: 74 human_in_the_loop_required: 98 operations: - path: /api_keys/validations method: post operationId: ApiKeysController_validateApiKey x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /api_keys/{id} method: delete operationId: ApiKeysController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /audit_logs/actions method: get operationId: AuditLogValidatorsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /audit_logs/actions/{actionName}/schemas method: post operationId: AuditLogValidatorVersionsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /audit_logs/actions/{actionName}/schemas method: get operationId: AuditLogValidatorVersionsController_schemas x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /audit_logs/events method: post operationId: AuditLogEventsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /audit_logs/exports method: post operationId: AuditLogExportsController_exports x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /audit_logs/exports/{auditLogExportId} method: get operationId: AuditLogExportsController_export x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/challenges/{id}/verify method: post operationId: AuthenticationChallengesController_verify x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /auth/factors/enroll method: post operationId: AuthenticationFactorsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /auth/factors/{id} method: get operationId: AuthenticationFactorsController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /auth/factors/{id} method: delete operationId: AuthenticationFactorsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /auth/factors/{id}/challenge method: post operationId: AuthenticationFactorsController_challenge x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authkit/oauth2/complete method: post operationId: ExternalAuthController_completeLogin x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organization_memberships/{organization_membership_id}/check method: post operationId: AuthorizationController_check x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organization_memberships/{organization_membership_id}/resources method: get operationId: AuthorizationController_listResourcesForMembership x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/organization_memberships/{organization_membership_id}/resources/{resource_id}/permissions method: get operationId: AuthorizationController_listEffectivePermissions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/organization_memberships/{organization_membership_id}/resources/{resource_type_slug}/{external_id}/permissions method: get operationId: AuthorizationController_listEffectivePermissionsByExternalId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/organization_memberships/{organization_membership_id}/role_assignments method: get operationId: AuthorizationRoleAssignmentsController_listRoleAssignments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/organization_memberships/{organization_membership_id}/role_assignments method: post operationId: AuthorizationRoleAssignmentsController_assignRole x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organization_memberships/{organization_membership_id}/role_assignments method: delete operationId: AuthorizationRoleAssignmentsController_removeRoleByCriteria x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organization_memberships/{organization_membership_id}/role_assignments/{role_assignment_id} method: delete operationId: AuthorizationRoleAssignmentsController_removeRoleById x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organizations/{organizationId}/roles method: post operationId: AuthorizationOrganizationRolesController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organizations/{organizationId}/roles method: get operationId: AuthorizationOrganizationRolesController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/organizations/{organizationId}/roles/{slug} method: get operationId: AuthorizationOrganizationRolesController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/organizations/{organizationId}/roles/{slug} method: patch operationId: AuthorizationOrganizationRolesController_update x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organizations/{organizationId}/roles/{slug} method: delete operationId: AuthorizationOrganizationRolesController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organizations/{organizationId}/roles/{slug}/permissions method: put operationId: AuthorizationOrganizationRolePermissionsController_setPermissions x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organizations/{organizationId}/roles/{slug}/permissions method: post operationId: AuthorizationOrganizationRolePermissionsController_addPermission x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organizations/{organizationId}/roles/{slug}/permissions/{permissionSlug} method: delete operationId: AuthorizationOrganizationRolePermissionsController_removePermission x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id} method: get operationId: AuthorizationResourcesByExternalIdController_getByExternalId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id} method: patch operationId: AuthorizationResourcesByExternalIdController_updateByExternalId x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id} method: delete operationId: AuthorizationResourcesByExternalIdController_deleteByExternalId x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}/organization_memberships method: get operationId: AuthorizationResourcesByExternalIdController_listOrganizationMembershipsForResourceByExternalId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}/role_assignments method: get operationId: AuthorizationRoleAssignmentsController_listRoleAssignmentsForResourceByExternalId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/permissions method: get operationId: AuthorizationPermissionsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/permissions method: post operationId: AuthorizationPermissionsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/permissions/{slug} method: get operationId: AuthorizationPermissionsController_find x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/permissions/{slug} method: patch operationId: AuthorizationPermissionsController_update x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/permissions/{slug} method: delete operationId: AuthorizationPermissionsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/resources method: get operationId: AuthorizationResourcesController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/resources method: post operationId: AuthorizationResourcesController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/resources/{resource_id} method: get operationId: AuthorizationResourcesController_findById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/resources/{resource_id} method: patch operationId: AuthorizationResourcesController_update x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/resources/{resource_id} method: delete operationId: AuthorizationResourcesController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/resources/{resource_id}/organization_memberships method: get operationId: AuthorizationResourcesController_listOrganizationMembershipsForResource x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/resources/{resource_id}/role_assignments method: get operationId: AuthorizationRoleAssignmentsController_listRoleAssignmentsForResource x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/roles method: post operationId: AuthorizationRolesController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/roles method: get operationId: AuthorizationRolesController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/roles/{slug} method: get operationId: AuthorizationRolesController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /authorization/roles/{slug} method: patch operationId: AuthorizationRolesController_update x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/roles/{slug}/permissions method: put operationId: AuthorizationRolePermissionsController_setPermissions x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /authorization/roles/{slug}/permissions method: post operationId: AuthorizationRolePermissionsController_addPermission x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /connect/applications method: get operationId: ApplicationsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /connect/applications method: post operationId: ApplicationsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /connect/applications/{id} method: get operationId: ApplicationsController_find x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /connect/applications/{id} method: put operationId: ApplicationsController_update x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /connect/applications/{id} method: delete operationId: ApplicationsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /connect/applications/{id}/client_secrets method: get operationId: ApplicationCredentialsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /connect/applications/{id}/client_secrets method: post operationId: ApplicationCredentialsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /connect/client_secrets/{id} method: delete operationId: ApplicationCredentialsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /connections method: get operationId: ConnectionsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /connections/{id} method: get operationId: ConnectionsController_find x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /connections/{id} method: delete operationId: ConnectionsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /data-integrations/{slug}/authorize method: post operationId: DataIntegrationsController_getDataIntegrationAuthorizeUrl x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /data-integrations/{slug}/token method: post operationId: DataIntegrationsController_getUserlandUserToken x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /directories method: get operationId: DirectoriesController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /directories/{id} method: get operationId: DirectoriesController_find x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /directories/{id} method: delete operationId: DirectoriesController_deleteDirectory x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /directory_groups method: get operationId: DirectoryGroupsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /directory_groups/{id} method: get operationId: DirectoryGroupsController_find x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /directory_users method: get operationId: DirectoryUsersController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /directory_users/{id} method: get operationId: DirectoryUsersController_find x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /events method: get operationId: EventsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /feature-flags method: get operationId: FeatureFlagsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /feature-flags/{slug} method: get operationId: FeatureFlagsController_findBySlug x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /feature-flags/{slug}/disable method: put operationId: FeatureFlagsController_disableFlag x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /feature-flags/{slug}/enable method: put operationId: FeatureFlagsController_enableFlag x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /feature-flags/{slug}/targets/{resourceId} method: post operationId: FlagTargetsController_createTarget x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /feature-flags/{slug}/targets/{resourceId} method: delete operationId: FlagTargetsController_deleteTarget x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organization_domains method: post operationId: OrganizationDomainsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organization_domains/{id} method: get operationId: OrganizationDomainsController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organization_domains/{id} method: delete operationId: OrganizationDomainsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organization_domains/{id}/verify method: post operationId: OrganizationDomainsController_verify x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organizations method: get operationId: OrganizationsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations method: post operationId: OrganizationsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organizations/external_id/{external_id} method: get operationId: OrganizationsController_getByExternalId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{id} method: get operationId: OrganizationsController_find x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{id} method: put operationId: OrganizationsController_updateOrganization x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organizations/{id} method: delete operationId: OrganizationsController_deleteOrganization x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organizations/{id}/audit_log_configuration method: get operationId: OrganizationsController_getAuditLogConfiguration x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{id}/audit_logs_retention method: get operationId: AuditLogsRetentionController_auditLogsRetention x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{id}/audit_logs_retention method: put operationId: AuditLogsRetentionController_updateAuditLogsRetention x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organizations/{organizationId}/api_keys method: get operationId: OrganizationApiKeysController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{organizationId}/api_keys method: post operationId: OrganizationApiKeysController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organizations/{organizationId}/feature-flags method: get operationId: OrganizationFeatureFlagsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{organizationId}/groups method: post operationId: GroupsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organizations/{organizationId}/groups method: get operationId: GroupsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{organizationId}/groups/{groupId} method: get operationId: GroupsController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{organizationId}/groups/{groupId} method: patch operationId: GroupsController_update x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organizations/{organizationId}/groups/{groupId} method: delete operationId: GroupsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organizations/{organizationId}/groups/{groupId}/organization-memberships method: post operationId: GroupMembershipsController_addMember x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /organizations/{organizationId}/groups/{groupId}/organization-memberships method: get operationId: GroupMembershipsController_listMembers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /organizations/{organizationId}/groups/{groupId}/organization-memberships/{omId} method: delete operationId: GroupMembershipsController_removeMember x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /portal/generate_link method: post operationId: PortalSessionsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /radar/attempts method: post operationId: RadarStandaloneController_assess x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /radar/attempts/{id} method: put operationId: RadarStandaloneController_updateRadarAttempt x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /radar/lists/{type}/{action} method: post operationId: RadarStandaloneController_updateRadarList x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /radar/lists/{type}/{action} method: delete operationId: RadarStandaloneController_deleteRadarListEntry x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sso/authorize method: get operationId: SsoController_authorize x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sso/jwks/{clientId} method: get operationId: SsoController_jsonWebKeySet x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sso/logout method: get operationId: SsoController_logout x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sso/logout/authorize method: post operationId: SsoController_logoutAuthorize x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /sso/profile method: get operationId: SsoController_getProfile x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /sso/token method: post operationId: SsoController_token x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/authenticate method: post operationId: UserlandSessionsController_authenticate[0] x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/authorize method: get operationId: UserlandSsoController_authorize x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/authorize/device method: post operationId: UserlandSsoController_deviceAuthorization x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/cors_origins method: post operationId: CorsOriginsController_createCorsOrigin x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/email_verification/{id} method: get operationId: UserlandUsersController_getEmailVerification x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/invitations method: get operationId: UserlandUserInvitesController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/invitations method: post operationId: UserlandUserInvitesController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/invitations/by_token/{token} method: get operationId: UserlandUserInvitesController_getByToken x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/invitations/{id} method: get operationId: UserlandUserInvitesController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/invitations/{id}/accept method: post operationId: UserlandUserInvitesController_accept x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/invitations/{id}/resend method: post operationId: UserlandUserInvitesController_resend x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/invitations/{id}/revoke method: post operationId: UserlandUserInvitesController_revoke x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/jwt_template method: get operationId: JwtTemplatesController_getJwtTemplate x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/jwt_template method: put operationId: JwtTemplatesController_updateJwtTemplate x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/magic_auth method: post operationId: UserlandMagicAuthController_sendMagicAuthCodeAndReturn x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/magic_auth/{id} method: get operationId: UserlandMagicAuthController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/organization_memberships method: get operationId: UserlandUserOrganizationMembershipsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/organization_memberships method: post operationId: UserlandUserOrganizationMembershipsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/organization_memberships/{id} method: get operationId: UserlandUserOrganizationMembershipsController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/organization_memberships/{id} method: delete operationId: UserlandUserOrganizationMembershipsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/organization_memberships/{id} method: put operationId: UserlandUserOrganizationMembershipsController_update x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/organization_memberships/{id}/deactivate method: put operationId: UserlandUserOrganizationMembershipsController_deactivate x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/organization_memberships/{id}/reactivate method: put operationId: UserlandUserOrganizationMembershipsController_reactivate x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/organization_memberships/{omId}/groups method: get operationId: OrganizationMembershipGroupsController_listGroups x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/password_reset method: post operationId: UserlandUsersController_createPasswordResetToken x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/password_reset/confirm method: post operationId: UserlandUsersController_resetPassword[0] x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/password_reset/{id} method: get operationId: UserlandUsersController_getPasswordReset x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/redirect_uris method: post operationId: RedirectUrisController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/sessions/logout method: get operationId: UserlandSessionsController_logout x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/sessions/revoke method: post operationId: UserlandSessionsController_revokeSession x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users method: get operationId: UserlandUsersController_list[0] x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/users method: post operationId: UserlandUsersController_create[0] x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/external_id/{external_id} method: get operationId: UserlandUsersController_getByExternalId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/users/{id} method: put operationId: UserlandUsersController_update[0] x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/{id} method: get operationId: UserlandUsersController_get[0] x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/users/{id} method: delete operationId: UserlandUsersController_delete[0] x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/{id}/email_change/confirm method: post operationId: UserlandUsersController_confirmEmailChange x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/{id}/email_change/send method: post operationId: UserlandUsersController_sendEmailChange x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/{id}/email_verification/confirm method: post operationId: UserlandUsersController_emailVerification[0] x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/{id}/email_verification/send method: post operationId: UserlandUsersController_sendVerificationEmail[0] x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/{id}/identities method: get operationId: UserlandUserIdentitiesController_get x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/users/{id}/sessions method: get operationId: UserlandUserSessionsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/users/{userId}/api_keys method: get operationId: UserApiKeysController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/users/{userId}/api_keys method: post operationId: UserApiKeysController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/{userId}/feature-flags method: get operationId: UserlandUserFeatureFlagsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/users/{user_id}/authorized_applications method: get operationId: AuthorizedApplicationsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/users/{user_id}/authorized_applications/{application_id} method: delete operationId: AuthorizedApplicationsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/{user_id}/connected_accounts/{slug} method: get operationId: DataIntegrationsUserManagementController_getUserDataInstallation x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/users/{user_id}/connected_accounts/{slug} method: delete operationId: DataIntegrationsUserManagementController_deleteUserDataInstallation x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/{user_id}/data_providers method: get operationId: DataIntegrationsUserManagementController_getUserDataIntegrations x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /user_management/users/{userlandUserId}/auth_factors method: post operationId: UserlandUserAuthenticationFactorsController_create[0] x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /user_management/users/{userlandUserId}/auth_factors method: get operationId: UserlandUserAuthenticationFactorsController_list[0] x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /webhook_endpoints method: get operationId: WebhookEndpointsController_list x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /webhook_endpoints method: post operationId: WebhookEndpointsController_create x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /webhook_endpoints/{id} method: patch operationId: WebhookEndpointsController_update x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /webhook_endpoints/{id} method: delete operationId: WebhookEndpointsController_delete x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /widgets/token method: post operationId: WidgetsPublicController_issueWidgetSessionToken x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required