Amazon Web Services · Agentic Access

Amazon Web Services Agentic Access

x-agentic-access generated

Amazon Web Services exposes 5181 API operations that an AI agent could call, of which 3518 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.

By consequence: 1663 read, 3248 write, 123 physical, and 147 safety-critical.

147 operations are classed safety-critical and should require human-in-the-loop approval at runtime.

Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.

AmazonCloudNetworkIndex
Operations: 5181 Acting: 3518 Human-in-the-loop: 147 Method: generated

By consequence

read 1663 write 3248 physical 123 safety-critical 147

Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.

MethodPathConsequenceHuman-in-loop
POST / safety-critical required
POST / safety-critical required
POST / safety-critical required
POST / safety-critical required
POST /2013-04-01/hostedzone/{Id}/disable-dnssec safety-critical required
POST /2015-01-01/es/domain/{DomainName}/revokeVpcEndpointAccess safety-critical required
PUT /2017-08-29/presets/{name} safety-critical required
PUT /2020-05-31/origin-access-control/{Id}/config safety-critical required
POST /2020-08-01/studios/{studioId}/streaming-sessions/{sessionId}/stop safety-critical required
POST /2020-11-20/projects/{projectName}/models/{modelVersion}/stop safety-critical required
POST /2021-01-01/opensearch/domain/{DomainName}/revokeVpcEndpointAccess safety-critical required
PUT /2022-01-01/osis/stopPipeline/{PipelineName} safety-critical required
POST /BatchRevokePermissions safety-critical required
POST /RevokePermissions safety-critical required
POST /StopComposition safety-critical required
POST /StopFailback safety-critical required
POST /StopReplication safety-critical required
POST /StopReplication safety-critical required
POST /StopSourceNetworkReplication safety-critical required
POST /StopStream safety-critical required
POST /TerminateRecoveryInstances safety-critical required
POST /TerminateTargetInstances safety-critical required
POST /accounts/{accountId}/users/{userId}?operation=reset-personal-pin safety-critical required
POST /admin/disable safety-critical required
POST /alarms/disable safety-critical required

Source

Agentic Access

Raw ↑ 
generated: '2026-07-15'
method: generated
source: openapi/accessanalyzer-openapi-original.yml, openapi/account-openapi-original.yml, openapi/acm-openapi-original.yml,
  openapi/acm-pca-openapi-original.yml, openapi/amp-openapi-original.yml, openapi/amplify-openapi-original.yml,
  openapi/amplifybackend-openapi-original.yml, openapi/amplifyuibuilder-openapi-original.yml,
  openapi/apigateway-openapi-original.yml, openapi/apigatewaymanagementapi-openapi-original.yml,
  openapi/apigatewayv2-openapi-original.yml, openapi/appconfig-openapi-original.yml, openapi/appconfigdata-openapi-original.yml,
  openapi/appfabric-openapi-original.yml, openapi/appflow-openapi-original.yml, openapi/appintegrations-openapi-original.yml,
  openapi/application-autoscaling-openapi-original.yml, openapi/application-insights-openapi-original.yml,
  openapi/applicationcostprofiler-openapi-original.yml, openapi/appmesh-openapi-original.yml,
  openapi/apprunner-openapi-original.yml, openapi/appstream-openapi-original.yml, openapi/appsync-openapi-original.yml,
  openapi/arc-zonal-shift-openapi-original.yml, openapi/athena-openapi-original.yml, openapi/auditmanager-openapi-original.yml,
  openapi/autoscaling-openapi-original.yml, openapi/autoscaling-plans-openapi-original.yml,
  openapi/awsmigrationhub-openapi-original.yml, openapi/b2bi-openapi-original.yml, openapi/backup-gateway-openapi-original.yml,
  openapi/backup-openapi-original.yml, openapi/backupstorage-openapi-original.yml, openapi/batch-openapi-original.yml,
  openapi/bcm-data-exports-openapi-original.yml, openapi/bedrock-agent-openapi-original.yml,
  openapi/bedrock-agent-runtime-openapi-original.yml, openapi/bedrock-openapi-original.yml,
  openapi/bedrock-runtime-openapi-original.yml, openapi/billingconductor-openapi-original.yml,
  openapi/braket-openapi-original.yml, openapi/budgets-openapi-original.yml, openapi/ce-openapi-original.yml,
  openapi/chime-openapi-original.yml, openapi/chime-sdk-identity-openapi-original.yml, openapi/chime-sdk-media-pipelines-openapi-original.yml,
  openapi/chime-sdk-meetings-openapi-original.yml, openapi/chime-sdk-messaging-openapi-original.yml,
  openapi/chime-sdk-voice-openapi-original.yml, openapi/cleanrooms-openapi-original.yml, openapi/cleanroomsml-openapi-original.yml,
  openapi/cloud9-openapi-original.yml, openapi/cloudcontrol-openapi-original.yml, openapi/clouddirectory-openapi-original.yml,
  openapi/cloudformation-openapi-original.yml, openapi/cloudfront-keyvaluestore-openapi-original.yml,
  openapi/cloudfront-openapi-original.yml, openapi/cloudhsm-openapi-original.yml, openapi/cloudhsmv2-openapi-original.yml,
  openapi/cloudsearch-openapi-original.yml, openapi/cloudsearchdomain-openapi-original.yml,
  openapi/cloudtrail-data-openapi-original.yml, openapi/cloudtrail-openapi-original.yml, openapi/codeartifact-openapi-original.yml,
  openapi/codebuild-openapi-original.yml, openapi/codecatalyst-openapi-original.yml, openapi/codecommit-openapi-original.yml,
  openapi/codedeploy-openapi-original.yml, openapi/codeguru-reviewer-openapi-original.yml, openapi/codeguru-security-openapi-original.yml,
  openapi/codeguruprofiler-openapi-original.yml, openapi/codepipeline-openapi-original.yml,
  openapi/codestar-connections-openapi-original.yml, openapi/codestar-notifications-openapi-original.yml,
  openapi/codestar-openapi-original.yml, openapi/cognito-identity-openapi-original.yml, openapi/cognito-idp-openapi-original.yml,
  openapi/cognito-sync-openapi-original.yml, openapi/comprehend-openapi-original.yml, openapi/comprehendmedical-openapi-original.yml,
  openapi/compute-optimizer-openapi-original.yml, openapi/config-openapi-original.yml, openapi/connect-contact-lens-openapi-original.yml,
  openapi/connect-openapi-original.yml, openapi/connectcampaigns-openapi-original.yml, openapi/connectcases-openapi-original.yml,
  openapi/connectparticipant-openapi-original.yml, openapi/controltower-openapi-original.yml,
  openapi/cost-optimization-hub-openapi-original.yml, openapi/cur-openapi-original.yml, openapi/customer-profiles-openapi-original.yml,
  openapi/databrew-openapi-original.yml, openapi/dataexchange-openapi-original.yml, openapi/datapipeline-openapi-original.yml,
  openapi/datasync-openapi-original.yml, openapi/datazone-openapi-original.yml, openapi/dax-openapi-original.yml,
  openapi/detective-openapi-original.yml, openapi/devicefarm-openapi-original.yml, openapi/devops-guru-openapi-original.yml,
  openapi/directconnect-openapi-original.yml, openapi/discovery-openapi-original.yml, openapi/dlm-openapi-original.yml,
  openapi/dms-openapi-original.yml, openapi/docdb-elastic-openapi-original.yml, openapi/docdb-openapi-original.yml,
  openapi/drs-openapi-original.yml, openapi/ds-openapi-original.yml, openapi/dynamodb-openapi-original.yml,
  openapi/ebs-openapi-original.yml, openapi/ec2-instance-connect-openapi-original.yml, openapi/ec2-openapi-original.yml,
  openapi/ecr-openapi-original.yml, openapi/ecr-public-openapi-original.yml, openapi/ecs-openapi-original.yml,
  openapi/eks-auth-openapi-original.yml, openapi/eks-openapi-original.yml, openapi/elastic-inference-openapi-original.yml,
  openapi/elasticache-openapi-original.yml, openapi/elasticbeanstalk-openapi-original.yml, openapi/elasticfilesystem-openapi-original.yml,
  openapi/elasticloadbalancing-openapi-original.yml, openapi/elasticloadbalancingv2-openapi-original.yml,
  openapi/elasticmapreduce-openapi-original.yml, openapi/elastictranscoder-openapi-original.yml,
  openapi/email-openapi-original.yml, openapi/emr-containers-openapi-original.yml, openapi/emr-serverless-openapi-original.yml,
  openapi/entitlementmarketplace-openapi-original.yml, openapi/entityresolution-openapi-original.yml,
  openapi/es-openapi-original.yml, openapi/eventbridge-openapi-original.yml, openapi/events-openapi-original.yml,
  openapi/evidently-openapi-original.yml, openapi/finspace-data-openapi-original.yml, openapi/finspace-openapi-original.yml,
  openapi/firehose-openapi-original.yml, openapi/fis-openapi-original.yml, openapi/fms-openapi-original.yml,
  openapi/forecast-openapi-original.yml, openapi/forecastquery-openapi-original.yml, openapi/frauddetector-openapi-original.yml,
  openapi/freetier-openapi-original.yml, openapi/fsx-openapi-original.yml, openapi/gamelift-openapi-original.yml,
  openapi/glacier-openapi-original.yml, openapi/globalaccelerator-openapi-original.yml, openapi/glue-openapi-original.yml,
  openapi/grafana-openapi-original.yml, openapi/greengrass-openapi-original.yml, openapi/greengrassv2-openapi-original.yml,
  openapi/groundstation-openapi-original.yml, openapi/guardduty-openapi-original.yml, openapi/health-openapi-original.yml,
  openapi/healthlake-openapi-original.yml, openapi/honeycode-openapi-original.yml, openapi/iam-openapi-original.yml,
  openapi/identitystore-openapi-original.yml, openapi/imagebuilder-openapi-original.yml, openapi/importexport-openapi-original.yml,
  openapi/inspector-openapi-original.yml, openapi/inspector-scan-openapi-original.yml, openapi/inspector2-openapi-original.yml,
  openapi/internetmonitor-openapi-original.yml, openapi/iot-data-openapi-original.yml, openapi/iot-jobs-data-openapi-original.yml,
  openapi/iot-openapi-original.yml, openapi/iot-roborunner-openapi-original.yml, openapi/iot1click-devices-openapi-original.yml,
  openapi/iot1click-projects-openapi-original.yml, openapi/iotanalytics-openapi-original.yml,
  openapi/iotdeviceadvisor-openapi-original.yml, openapi/iotevents-data-openapi-original.yml,
  openapi/iotevents-openapi-original.yml, openapi/iotfleethub-openapi-original.yml, openapi/iotfleetwise-openapi-original.yml,
  openapi/iotsecuretunneling-openapi-original.yml, openapi/iotsitewise-openapi-original.yml,
  openapi/iotthingsgraph-openapi-original.yml, openapi/iottwinmaker-openapi-original.yml, openapi/iotwireless-openapi-original.yml,
  openapi/ivs-openapi-original.yml, openapi/ivs-realtime-openapi-original.yml, openapi/ivschat-openapi-original.yml,
  openapi/kafka-openapi-original.yml, openapi/kafkaconnect-openapi-original.yml, openapi/kendra-openapi-original.yml,
  openapi/kendra-ranking-openapi-original.yml, openapi/keyspaces-openapi-original.yml, openapi/kinesis-openapi-original.yml,
  openapi/kinesis-video-archived-media-openapi-original.yml, openapi/kinesis-video-media-openapi-original.yml,
  openapi/kinesis-video-signaling-openapi-original.yml, openapi/kinesis-video-webrtc-storage-openapi-original.yml,
  openapi/kinesisanalytics-openapi-original.yml, openapi/kinesisanalyticsv2-openapi-original.yml,
  openapi/kinesisvideo-openapi-original.yml, openapi/kms-openapi-original.yml, openapi/lakeformation-openapi-original.yml,
  openapi/lambda-openapi-original.yml, openapi/launch-wizard-openapi-original.yml, openapi/lex-models-openapi-original.yml,
  openapi/license-manager-linux-subscriptions-openapi-original.yml, openapi/license-manager-openapi-original.yml,
  openapi/license-manager-user-subscriptions-openapi-original.yml, openapi/lightsail-openapi-original.yml,
  openapi/location-openapi-original.yml, openapi/logs-openapi-original.yml, openapi/lookoutequipment-openapi-original.yml,
  openapi/lookoutmetrics-openapi-original.yml, openapi/lookoutvision-openapi-original.yml, openapi/m2-openapi-original.yml,
  openapi/machinelearning-openapi-original.yml, openapi/macie2-openapi-original.yml, openapi/managedblockchain-openapi-original.yml,
  openapi/managedblockchain-query-openapi-original.yml, openapi/marketplace-agreement-openapi-original.yml,
  openapi/marketplace-catalog-openapi-original.yml, openapi/marketplace-deployment-openapi-original.yml,
  openapi/marketplacecommerceanalytics-openapi-original.yml, openapi/mediaconnect-openapi-original.yml,
  openapi/mediaconvert-openapi-original.yml, openapi/medialive-openapi-original.yml, openapi/mediapackage-openapi-original.yml,
  openapi/mediapackage-vod-openapi-original.yml, openapi/mediapackagev2-openapi-original.yml,
  openapi/mediastore-data-openapi-original.yml, openapi/mediastore-openapi-original.yml, openapi/mediatailor-openapi-original.yml,
  openapi/medical-imaging-openapi-original.yml, openapi/memorydb-openapi-original.yml, openapi/meteringmarketplace-openapi-original.yml,
  openapi/mgn-openapi-original.yml, openapi/migration-hub-refactor-spaces-openapi-original.yml,
  openapi/migrationhub-config-openapi-original.yml, openapi/migrationhuborchestrator-openapi-original.yml,
  openapi/migrationhubstrategy-openapi-original.yml, openapi/mobile-openapi-original.yml, openapi/modelslexv2-openapi-original.yml,
  openapi/monitoring-openapi-original.yml, openapi/mq-openapi-original.yml, openapi/mturk-requester-openapi-original.yml,
  openapi/mwaa-openapi-original.yml, openapi/neptune-graph-openapi-original.yml, openapi/neptune-openapi-original.yml,
  openapi/neptunedata-openapi-original.yml, openapi/network-firewall-openapi-original.yml, openapi/networkmanager-openapi-original.yml,
  openapi/networkmonitor-openapi-original.yml, openapi/nimble-openapi-original.yml, openapi/oam-openapi-original.yml,
  openapi/omics-openapi-original.yml, openapi/opensearch-openapi-original.yml, openapi/opensearchserverless-openapi-original.yml,
  openapi/opsworks-openapi-original.yml, openapi/opsworkscm-openapi-original.yml, openapi/organizations-openapi-original.yml,
  openapi/osis-openapi-original.yml, openapi/outposts-openapi-original.yml, openapi/panorama-openapi-original.yml,
  openapi/payment-cryptography-data-openapi-original.yml, openapi/payment-cryptography-openapi-original.yml,
  openapi/pca-connector-ad-openapi-original.yml, openapi/personalize-events-openapi-original.yml,
  openapi/personalize-openapi-original.yml, openapi/personalize-runtime-openapi-original.yml,
  openapi/pi-openapi-original.yml, openapi/pinpoint-email-openapi-original.yml, openapi/pinpoint-openapi-original.yml,
  openapi/pinpoint-sms-voice-v2-openapi-original.yml, openapi/pipes-openapi-original.yml, openapi/polly-openapi-original.yml,
  openapi/pricing-openapi-original.yml, openapi/privatenetworks-openapi-original.yml, openapi/proton-openapi-original.yml,
  openapi/qbusiness-openapi-original.yml, openapi/qconnect-openapi-original.yml, openapi/qldb-openapi-original.yml,
  openapi/qldb-session-openapi-original.yml, openapi/quicksight-openapi-original.yml, openapi/ram-openapi-original.yml,
  openapi/rbin-openapi-original.yml, openapi/rds-data-openapi-original.yml, openapi/rds-openapi-original.yml,
  openapi/redshift-data-openapi-original.yml, openapi/redshift-openapi-original.yml, openapi/redshift-serverless-openapi-original.yml,
  openapi/rekognition-openapi-original.yml, openapi/repostspace-openapi-original.yml, openapi/resiliencehub-openapi-original.yml,
  openapi/resource-explorer-2-openapi-original.yml, openapi/resource-groups-openapi-original.yml,
  openapi/resourcegroupstaggingapi-openapi-original.yml, openapi/robomaker-openapi-original.yml,
  openapi/rolesanywhere-openapi-original.yml, openapi/route53-openapi-original.yml, openapi/route53-recovery-cluster-openapi-original.yml,
  openapi/route53-recovery-control-config-openapi-original.yml, openapi/route53-recovery-readiness-openapi-original.yml,
  openapi/route53domains-openapi-original.yml, openapi/route53resolver-openapi-original.yml,
  openapi/rum-openapi-original.yml, openapi/runtimelex-openapi-original.yml, openapi/runtimelexv2-openapi-original.yml,
  openapi/runtimesagemaker-openapi-original.yml, openapi/s3-openapi-original.yml, openapi/s3control-openapi-original.yml,
  openapi/s3outposts-openapi-original.yml, openapi/sagemaker-a2i-runtime-openapi-original.yml,
  openapi/sagemaker-edge-openapi-original.yml, openapi/sagemaker-featurestore-runtime-openapi-original.yml,
  openapi/sagemaker-geospatial-openapi-original.yml, openapi/sagemaker-metrics-openapi-original.yml,
  openapi/sagemaker-openapi-original.yml, openapi/savingsplans-openapi-original.yml, openapi/scheduler-openapi-original.yml,
  openapi/schemas-openapi-original.yml, openapi/sdb-openapi-original.yml, openapi/secretsmanager-openapi-original.yml,
  openapi/securityhub-openapi-original.yml, openapi/securitylake-openapi-original.yml, openapi/serverlessrepo-openapi-original.yml,
  openapi/service-quotas-openapi-original.yml, openapi/servicecatalog-appregistry-openapi-original.yml,
  openapi/servicecatalog-openapi-original.yml, openapi/servicediscovery-openapi-original.yml,
  openapi/sesv2-openapi-original.yml, openapi/shield-openapi-original.yml, openapi/signer-openapi-original.yml,
  openapi/simspaceweaver-openapi-original.yml, openapi/sms-openapi-original.yml, openapi/sms-voice-openapi-original.yml,
  openapi/snow-device-management-openapi-original.yml, openapi/snowball-openapi-original.yml,
  openapi/sns-openapi-original.yml, openapi/sqs-openapi-original.yml, openapi/ssm-contacts-openapi-original.yml,
  openapi/ssm-incidents-openapi-original.yml, openapi/ssm-openapi-original.yml, openapi/ssm-sap-openapi-original.yml,
  openapi/sso-admin-openapi-original.yml, openapi/sso-oidc-openapi-original.yml, openapi/sso-openapi-original.yml,
  openapi/states-openapi-original.yml, openapi/storagegateway-openapi-original.yml, openapi/streamsdynamodb-openapi-original.yml,
  openapi/sts-openapi-original.yml, openapi/supplychain-openapi-original.yml, openapi/support-app-openapi-original.yml,
  openapi/support-openapi-original.yml, openapi/swf-openapi-original.yml, openapi/synthetics-openapi-original.yml,
  openapi/textract-openapi-original.yml, openapi/timestream-query-openapi-original.yml, openapi/timestream-write-openapi-original.yml,
  openapi/tnb-openapi-original.yml, openapi/transcribe-openapi-original.yml, openapi/transcribe-streaming-openapi-original.yml,
  openapi/transfer-openapi-original.yml, openapi/translate-openapi-original.yml, openapi/trustedadvisor-openapi-original.yml,
  openapi/verifiedpermissions-openapi-original.yml, openapi/voice-id-openapi-original.yml, openapi/vpc-lattice-openapi-original.yml,
  openapi/waf-openapi-original.yml, openapi/waf-regional-openapi-original.yml, openapi/wafv2-openapi-original.yml,
  openapi/wellarchitected-openapi-original.yml, openapi/wisdom-openapi-original.yml, openapi/workdocs-openapi-original.yml,
  openapi/worklink-openapi-original.yml, openapi/workmail-openapi-original.yml, openapi/workmailmessageflow-openapi-original.yml,
  openapi/workspaces-openapi-original.yml, openapi/workspaces-thin-client-openapi-original.yml,
  openapi/workspaces-web-openapi-original.yml, openapi/xray-openapi-original.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 5181
  by_action_class:
    acting: 3518
    connected: 1663
  by_consequence:
    write: 3248
    read: 1663
    safety-critical: 147
    physical: 123
  human_in_the_loop_required: 147
operations:
- path: /archive-rule
  method: put
  operationId: amazonWebServicesApplyArchiveRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /policy/generation/{jobId}
  method: get
  operationId: amazonWebServicesGetGeneratedPolicy
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /policy/check-access-not-granted
  method: post
  operationId: amazonWebServicesCheckAccessNotGranted
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /policy/check-no-new-access
  method: post
  operationId: amazonWebServicesCheckNoNewAccess
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /access-preview
  method: get
  operationId: amazonWebServicesListAccessPreviews
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /analyzer
  method: get
  operationId: amazonWebServicesListAnalyzers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /analyzer/{analyzerName}/archive-rule
  method: get
  operationId: amazonWebServicesListArchiveRules
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /analyzer/{analyzerName}
  method: get
  operationId: amazonWebServicesGetAnalyzer
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /analyzer/{analyzerName}/archive-rule/{ruleName}
  method: put
  operationId: amazonWebServicesUpdateArchiveRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /access-preview/{accessPreviewId}
  method: post
  operationId: amazonWebServicesListAccessPreviewFindings
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /analyzed-resource
  method: post
  operationId: amazonWebServicesListAnalyzedResources
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /finding/{id}
  method: get
  operationId: amazonWebServicesGetFinding
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /findingv2/{id}
  method: get
  operationId: amazonWebServicesGetFindingV2
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /finding
  method: put
  operationId: amazonWebServicesUpdateFindings
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /findingv2
  method: post
  operationId: amazonWebServicesListFindingsV2
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /policy/generation
  method: put
  operationId: amazonWebServicesStartPolicyGeneration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /tags/{resourceArn}
  method: delete
  operationId: amazonWebServicesUntagResource
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /resource/scan
  method: post
  operationId: amazonWebServicesStartResourceScan
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /policy/validation
  method: post
  operationId: amazonWebServicesValidatePolicy
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /deleteAlternateContact
  method: post
  operationId: amazonWebServicesDeleteAlternateContact
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /disableRegion
  method: post
  operationId: amazonWebServicesDisableRegion
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /enableRegion
  method: post
  operationId: amazonWebServicesEnableRegion
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /getAlternateContact
  method: post
  operationId: amazonWebServicesGetAlternateContact
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /getContactInformation
  method: post
  operationId: amazonWebServicesGetContactInformation
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /getRegionOptStatus
  method: post
  operationId: amazonWebServicesGetRegionOptStatus
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /listRegions
  method: post
  operationId: amazonWebServicesListRegions
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /putAlternateContact
  method: post
  operationId: amazonWebServicesPutAlternateContact
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /putContactInformation
  method: post
  operationId: amazonWebServicesPutContactInformation
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /
  method: post
  operationId: amazonWebServicesUpdateCertificateOptions
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /
  method: post
  operationId: amazonWebServicesUpdateCertificateAuthority
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /workspaces/{workspaceId}/alertmanager/definition
  method: put
  operationId: amazonWebServicesPutAlertManagerDefinition
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /workspaces/{workspaceId}/logging
  method: put
  operationId: amazonWebServicesUpdateLoggingConfiguration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /workspaces/{workspaceId}/rulegroupsnamespaces
  method: get
  operationId: amazonWebServicesListRuleGroupsNamespaces
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /scrapers
  method: get
  operationId: amazonWebServicesListScrapers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /workspaces
  method: get
  operationId: amazonWebServicesListWorkspaces
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /workspaces/{workspaceId}/rulegroupsnamespaces/{name}
  method: put
  operationId: amazonWebServicesPutRuleGroupsNamespace
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /scrapers/{scraperId}
  method: get
  operationId: amazonWebServicesDescribeScraper
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /workspaces/{workspaceId}
  method: get
  operationId: amazonWebServicesDescribeWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /scraperconfiguration
  method: get
  operationId: amazonWebServicesGetDefaultScraperConfiguration
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /tags/{resourceArn}
  method: delete
  operationId: amazonWebServicesUntagResource
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /workspaces/{workspaceId}/alias
  method: post
  operationId: amazonWebServicesUpdateWorkspaceAlias
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /apps
  method: get
  operationId: amazonWebServicesListApps
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /apps/{appId}/backendenvironments
  method: get
  operationId: amazonWebServicesListBackendEnvironments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /apps/{appId}/branches
  method: get
  operationId: amazonWebServicesListBranches
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /apps/{appId}/branches/{branchName}/deployments
  method: post
  operationId: amazonWebServicesCreateDeployment
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /apps/{appId}/domains
  method: get
  operationId: amazonWebServicesListDomainAssociations
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /apps/{appId}/webhooks
  method: get
  operationId: amazonWebServicesListWebhooks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /apps/{appId}
  method: post
  operationId: amazonWebServicesUpdateApp
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /apps/{appId}/backendenvironments/{environmentName}
  method: get
  operationId: amazonWebServicesGetBackendEnvironment
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /apps/{appId}/branches/{branchName}
  method: post
  operationId: amazonWebServicesUpdateBranch
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /apps/{appId}/domains/{domainName}
  method: post
  operationId: amazonWebServicesUpdateDo

# --- truncated at 32 KB (1711 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/amazon-web-services/refs/heads/main/agentic-access/amazon-web-services-agentic-access.yml