generated: '2026-07-15' method: generated source: openapi/yapily-beneficiaries-api-openapi.yml, openapi/yapily-consents-api-openapi.yml, openapi/yapily-data-api-openapi.yml, openapi/yapily-data-plus-api-openapi.yml, openapi/yapily-hosted-pages-api-openapi.yml, openapi/yapily-institutions-api-openapi.yml, openapi/yapily-payments-api-openapi.yml, openapi/yapily-platform-api-openapi.yml, openapi/yapily-vrp-api-openapi.yml description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind audience per deployment. See research/curity/agentic-governance/. summary: operations: 97 by_action_class: acting: 52 connected: 45 by_consequence: write: 32 read: 45 physical: 18 safety-critical: 2 human_in_the_loop_required: 2 operations: - path: /applications/{applicationId}/beneficiaries method: post operationId: createApplicationBeneficiary x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /applications/{applicationId}/beneficiaries method: get operationId: getApplicationBeneficiaries x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /applications/{applicationId}/beneficiaries/{beneficiaryId} method: get operationId: getApplicationBeneficiaryById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /applications/{applicationId}/beneficiaries/{beneficiaryId} method: delete operationId: deleteApplicationBeneficiaryById x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userId}/beneficiaries method: post operationId: createUserBeneficiary x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userId}/beneficiaries method: get operationId: getUserBeneficiaries x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /users/{userId}/beneficiaries/{beneficiaryId} method: patch operationId: patchUserBeneficiary x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userId}/beneficiaries/{beneficiaryId} method: get operationId: getUserBeneficiary x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /users/{userId}/beneficiaries/{beneficiaryId} method: delete operationId: deleteUserBeneficiary x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userId}/beneficiaries/{beneficiaryId}/approve method: post operationId: approveBeneficiary x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userId}/beneficiaries/{beneficiaryId}/reject method: post operationId: rejectBeneficiary x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /account-auth-requests method: patch operationId: reAuthoriseAccount x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /account-auth-requests method: post operationId: initiateAccountRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /account-auth-requests method: put operationId: updatePreAuthoriseAccountConsent x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /bulk-payment-auth-requests method: post operationId: createBulkPaymentAuthorisation x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /consent-auth-code method: post operationId: createConsentWithCode x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /consent-one-time-token method: post operationId: getConsentBySingleAccessConsent x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /consents method: get operationId: getConsents x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /consents/{consentId} method: delete operationId: delete x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /consents/{consentId} method: get operationId: getConsentById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /consents/{consentId}/extend method: post operationId: extendConsent x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /embedded-account-auth-requests method: post operationId: initiateEmbeddedAccountRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /embedded-account-auth-requests/{consentId} method: put operationId: updateEmbeddedAccountRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /embedded-bulk-payment-auth-requests method: post operationId: createEmbeddedBulkPaymentAuthorisation x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /embedded-bulk-payment-auth-requests/{consentId} method: put operationId: updateEmbeddedBulkPaymentAuthorisation x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /embedded-payment-auth-requests method: post operationId: createEmbeddedPaymentAuthorisation x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /embedded-payment-auth-requests/{consentId} method: put operationId: updateEmbeddedPaymentAuthorisation x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /payment-auth-requests method: post operationId: createPaymentAuthorisation x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /payment-auth-requests method: put operationId: updatePaymentAuthorisation x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /pre-auth-requests method: post operationId: createPreAuthorisationRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /payment-pre-auth-requests method: post operationId: createPaymentPreAuthorisationRequest x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts method: get operationId: getAccounts x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId} method: get operationId: getAccount x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/balances method: get operationId: getAccountBalances x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/beneficiaries method: get operationId: getBeneficiaries x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/direct-debits method: get operationId: getAccountDirectDebits x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/periodic-payments method: get operationId: getAccountPeriodicPayments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/scheduled-payments method: get operationId: getAccountScheduledPayments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/statements method: get operationId: getStatements x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/statements/{statementId} method: get operationId: getStatement x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/statements/{statementId}/file method: get operationId: getStatementFile x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/transactions method: get operationId: getTransactions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /identity method: get operationId: getIdentity x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/real-time/transactions method: get operationId: getRealTimeTransactions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /accounts/{accountId}/transactions/categorisation method: post operationId: post-accounts-accountId-transactions-categorisation x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /accounts/{accountId}/transactions/categorisation/{categorisationId} method: get operationId: get-accounts-transactions-categorised x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /transactions/categorisation method: post operationId: post-transactions-categorisation x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /transactions/categorisation/{categorisationId} method: get operationId: get-transactions-categorised x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /transactions/categorisation/categories/{accountType} method: get operationId: get-categorisation-accountType x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /hosted/consent-requests method: post operationId: createHostedConsentRequest x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /hosted/consent-requests/{consentRequestId} method: get operationId: getHostedConsentRequest x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /hosted/payment-requests method: post operationId: createHostedPaymentRequest x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /hosted/payment-requests/links method: post operationId: createHostedPaymentRequestLink x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /hosted/payment-requests/{paymentRequestId} method: get operationId: getHostedPaymentRequest x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /hosted/vrp/consent-requests method: post operationId: createHostedVRPConsentRequest x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /hosted/vrp/consent-requests method: get operationId: getHostedVRPConsentRequests x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /hosted/vrp/consent-requests/{consentRequestId} method: get operationId: getHostedVrpConsentRequest x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /hosted/vrp/consent-requests/{consentRequestId}/revoke method: post operationId: revokeHostedConsentRequest x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /hosted/vrp/consent-requests/{consentRequestId}/payments method: post operationId: createHostedVrpPayment x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /hosted/vrp/consent-requests/{consentRequestId}/payments/{paymentId} method: get operationId: getHostedVRPPaymentRequest x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /hosted/vrp/consent-requests/{consentRequestId}/funds-confirmation method: post operationId: createHostedVrpFundsConfirmation x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /institutions method: get operationId: getInstitutions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /institutions/{institutionId} method: get operationId: getInstitution x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /bulk-payments method: post operationId: createBulkPayment x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /bulk-payments/{bulkPaymentId} method: get operationId: getBulkPaymentStatus x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /bulk-payments/{bulkPaymentId}/details method: get operationId: getBulkPaymentDetailsById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /payments method: post operationId: createPayment x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /payments/{paymentId}/details method: get operationId: getPayments x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /users method: get operationId: getUsers x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /users method: post operationId: addUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userUuid} method: patch operationId: patchUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userUuid} method: delete operationId: deleteUser x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /users/{userUuid} method: get operationId: getUser x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /notifications/event-subscriptions method: post operationId: createEventSubscription x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /notifications/event-subscriptions method: get operationId: getEventSubscriptions x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /notifications/event-subscriptions/{eventTypeId} method: get operationId: getEventSubscriptionById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /notifications/event-subscriptions/{eventTypeId} method: delete operationId: deleteEventSubscriptionById x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /institutions/constraints/payments method: get operationId: getPaymentConstraintsRulesByInstitution x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /institutions/constraints/data method: get operationId: getAccountConstraintsRulesByInstitution x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /applications method: post operationId: createSubApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /applications method: get operationId: searchApplications x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /applications/{applicationId} method: get operationId: getApplicationById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /applications/{applicationId} method: put operationId: updateApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /applications/{applicationId} method: delete operationId: deleteApplication x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /applications/{applicationId}/vrp method: post operationId: createApplicationVRPConfigurationByApplicationId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /applications/{applicationId}/vrp method: put operationId: updateApplicationVRPConfigurationByApplicationId x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /applications/{applicationId}/vrp method: get operationId: getApplicationVRPConfigurationByApplicationId x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /webhook/events/categories method: get operationId: getWebhookEventsCategories x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /webhook/events method: post operationId: registerWebhook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /webhook/events method: get operationId: getRegisteredWebhooks x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /webhook/events/{webhook_id} method: delete operationId: deleteWebhook x-agentic-access: action-class: acting consequence: write subject: required audience: null token: max-ttl: 900 escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /webhook/secrets/{webhook_id} method: post operationId: webhookSecretReset x-agentic-access: action-class: acting consequence: safety-critical subject: required audience: null token: max-ttl: 120 exchange: true purpose-required: true proof-of-possession: true escalation: human-in-the-loop: required audit: required - path: /variable-recurring-payments/sweeping/consents method: post operationId: createSweepingAuthorisation x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /variable-recurring-payments/sweeping/consents/{consentId} method: get operationId: getSweepingVrpConsentById x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none - path: /variable-recurring-payments/funds-confirmation method: post operationId: createVrpFundsConfirmation x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /variable-recurring-payments/payments method: post operationId: createVrpPayment x-agentic-access: action-class: acting consequence: physical subject: required audience: null token: max-ttl: 300 exchange: true purpose-required: true escalation: human-in-the-loop: conditional triggers: - abnormal - high-value audit: required - path: /variable-recurring-payments/payments/{paymentId}/details method: get operationId: getVrpPaymentDetails x-agentic-access: action-class: connected consequence: read subject: optional token: max-ttl: 3600 audit: none