Amazon Directory Service Agentic Access
Amazon Directory Service exposes 67 API operations that an AI agent could call, of which 67 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.
By consequence: 60 write and 7 safety-critical.
7 operations are classed safety-critical and should require human-in-the-loop approval at runtime.
Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.
By consequence
Highest-consequence actions
The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.
| Method | Path | Consequence | Human-in-loop |
|---|---|---|---|
| POST | /#X-Amz-Target=DirectoryService_20150416.DescribeDomainControllers | safety-critical | required |
| POST | /#X-Amz-Target=DirectoryService_20150416.DisableClientAuthentication | safety-critical | required |
| POST | /#X-Amz-Target=DirectoryService_20150416.DisableLDAPS | safety-critical | required |
| POST | /#X-Amz-Target=DirectoryService_20150416.DisableRadius | safety-critical | required |
| POST | /#X-Amz-Target=DirectoryService_20150416.DisableSso | safety-critical | required |
| POST | /#X-Amz-Target=DirectoryService_20150416.ResetUserPassword | safety-critical | required |
| POST | /#X-Amz-Target=DirectoryService_20150416.UpdateNumberOfDomainControllers | safety-critical | required |
Source
Agentic Access
generated: '2026-07-15'
method: generated
source: openapi/amazon-directory-service-openapi.yaml
description: Recommended x-agentic-access execution contracts, classified heuristically from
the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
audience per deployment. See research/curity/agentic-governance/.
summary:
operations: 67
by_action_class:
acting: 67
by_consequence:
write: 60
safety-critical: 7
human_in_the_loop_required: 7
operations:
- path: /#X-Amz-Target=DirectoryService_20150416.AcceptSharedDirectory
method: post
operationId: AcceptSharedDirectory
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.AddIpRoutes
method: post
operationId: AddIpRoutes
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.AddRegion
method: post
operationId: AddRegion
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.AddTagsToResource
method: post
operationId: AddTagsToResource
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.CancelSchemaExtension
method: post
operationId: CancelSchemaExtension
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.ConnectDirectory
method: post
operationId: ConnectDirectory
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.CreateAlias
method: post
operationId: CreateAlias
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.CreateComputer
method: post
operationId: CreateComputer
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.CreateConditionalForwarder
method: post
operationId: CreateConditionalForwarder
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.CreateDirectory
method: post
operationId: CreateDirectory
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.CreateLogSubscription
method: post
operationId: CreateLogSubscription
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.CreateMicrosoftAD
method: post
operationId: CreateMicrosoftAD
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.CreateSnapshot
method: post
operationId: CreateSnapshot
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.CreateTrust
method: post
operationId: CreateTrust
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DeleteConditionalForwarder
method: post
operationId: DeleteConditionalForwarder
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DeleteDirectory
method: post
operationId: DeleteDirectory
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DeleteLogSubscription
method: post
operationId: DeleteLogSubscription
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DeleteSnapshot
method: post
operationId: DeleteSnapshot
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DeleteTrust
method: post
operationId: DeleteTrust
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DeregisterCertificate
method: post
operationId: DeregisterCertificate
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DeregisterEventTopic
method: post
operationId: DeregisterEventTopic
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeCertificate
method: post
operationId: DescribeCertificate
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeClientAuthenticationSettings
method: post
operationId: DescribeClientAuthenticationSettings
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeConditionalForwarders
method: post
operationId: DescribeConditionalForwarders
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeDirectories
method: post
operationId: DescribeDirectories
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeDomainControllers
method: post
operationId: DescribeDomainControllers
x-agentic-access:
action-class: acting
consequence: safety-critical
subject: required
audience: null
token:
max-ttl: 120
exchange: true
purpose-required: true
proof-of-possession: true
escalation:
human-in-the-loop: required
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeEventTopics
method: post
operationId: DescribeEventTopics
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeLDAPSSettings
method: post
operationId: DescribeLDAPSSettings
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeRegions
method: post
operationId: DescribeRegions
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeSettings
method: post
operationId: DescribeSettings
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeSharedDirectories
method: post
operationId: DescribeSharedDirectories
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeSnapshots
method: post
operationId: DescribeSnapshots
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeTrusts
method: post
operationId: DescribeTrusts
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DescribeUpdateDirectory
method: post
operationId: DescribeUpdateDirectory
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DisableClientAuthentication
method: post
operationId: DisableClientAuthentication
x-agentic-access:
action-class: acting
consequence: safety-critical
subject: required
audience: null
token:
max-ttl: 120
exchange: true
purpose-required: true
proof-of-possession: true
escalation:
human-in-the-loop: required
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DisableLDAPS
method: post
operationId: DisableLDAPS
x-agentic-access:
action-class: acting
consequence: safety-critical
subject: required
audience: null
token:
max-ttl: 120
exchange: true
purpose-required: true
proof-of-possession: true
escalation:
human-in-the-loop: required
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DisableRadius
method: post
operationId: DisableRadius
x-agentic-access:
action-class: acting
consequence: safety-critical
subject: required
audience: null
token:
max-ttl: 120
exchange: true
purpose-required: true
proof-of-possession: true
escalation:
human-in-the-loop: required
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.DisableSso
method: post
operationId: DisableSso
x-agentic-access:
action-class: acting
consequence: safety-critical
subject: required
audience: null
token:
max-ttl: 120
exchange: true
purpose-required: true
proof-of-possession: true
escalation:
human-in-the-loop: required
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.EnableClientAuthentication
method: post
operationId: EnableClientAuthentication
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.EnableLDAPS
method: post
operationId: EnableLDAPS
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.EnableRadius
method: post
operationId: EnableRadius
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.EnableSso
method: post
operationId: EnableSso
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.GetDirectoryLimits
method: post
operationId: GetDirectoryLimits
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.GetSnapshotLimits
method: post
operationId: GetSnapshotLimits
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.ListCertificates
method: post
operationId: ListCertificates
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.ListIpRoutes
method: post
operationId: ListIpRoutes
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.ListLogSubscriptions
method: post
operationId: ListLogSubscriptions
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.ListSchemaExtensions
method: post
operationId: ListSchemaExtensions
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.ListTagsForResource
method: post
operationId: ListTagsForResource
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.RegisterCertificate
method: post
operationId: RegisterCertificate
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.RegisterEventTopic
method: post
operationId: RegisterEventTopic
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.RejectSharedDirectory
method: post
operationId: RejectSharedDirectory
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.RemoveIpRoutes
method: post
operationId: RemoveIpRoutes
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.RemoveRegion
method: post
operationId: RemoveRegion
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.RemoveTagsFromResource
method: post
operationId: RemoveTagsFromResource
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.ResetUserPassword
method: post
operationId: ResetUserPassword
x-agentic-access:
action-class: acting
consequence: safety-critical
subject: required
audience: null
token:
max-ttl: 120
exchange: true
purpose-required: true
proof-of-possession: true
escalation:
human-in-the-loop: required
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.RestoreFromSnapshot
method: post
operationId: RestoreFromSnapshot
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.ShareDirectory
method: post
operationId: ShareDirectory
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.StartSchemaExtension
method: post
operationId: StartSchemaExtension
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.UnshareDirectory
method: post
operationId: UnshareDirectory
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.UpdateConditionalForwarder
method: post
operationId: UpdateConditionalForwarder
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.UpdateDirectorySetup
method: post
operationId: UpdateDirectorySetup
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.UpdateNumberOfDomainControllers
method: post
operationId: UpdateNumberOfDomainControllers
x-agentic-access:
action-class: acting
consequence: safety-critical
subject: required
audience: null
token:
max-ttl: 120
exchange: true
purpose-required: true
proof-of-possession: true
escalation:
human-in-the-loop: required
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.UpdateRadius
method: post
operationId: UpdateRadius
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.UpdateSettings
method: post
operationId: UpdateSettings
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.UpdateTrust
method: post
operationId: UpdateTrust
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /#X-Amz-Target=DirectoryService_20150416.VerifyTrust
method: post
operationId: VerifyTrust
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required