Codesphere Agentic Access
Codesphere exposes 80 API operations that an AI agent could call, of which 50 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.
By consequence: 30 read, 47 write, 2 physical, and 1 safety-critical.
1 operation are classed safety-critical and should require human-in-the-loop approval at runtime.
Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.
By consequence
Highest-consequence actions
The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.
| Method | Path | Consequence | Human-in-loop |
|---|---|---|---|
| POST | /workspaces/{workspaceId}/pipeline/{stage}/stop | safety-critical | required |
| POST | /workspaces/{workspaceId}/landscape/deploy | physical | conditional |
| POST | /workspaces/{workspaceId}/landscape/deploy/{profile} | physical | conditional |
Source
Agentic Access
generated: '2026-07-18'
method: generated
source: openapi/codesphere-openapi-original.json
description: Recommended x-agentic-access execution contracts, classified heuristically from
the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
audience per deployment. See research/curity/agentic-governance/.
summary:
operations: 80
by_action_class:
connected: 30
acting: 50
by_consequence:
read: 30
write: 47
physical: 2
safety-critical: 1
human_in_the_loop_required: 1
operations:
- path: /clusters/organizations
method: get
operationId: clusters-listAllOrganizations
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /clusters/organizations
method: post
operationId: clusters-createOrganization
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /clusters/admins
method: post
operationId: clusters-addClusterAdmin
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /domains/team/{teamId}/domain/{domainName}
method: get
operationId: domains-getDomain
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /domains/team/{teamId}/domain/{domainName}
method: post
operationId: domains-createDomain
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /domains/team/{teamId}/domain/{domainName}
method: patch
operationId: domains-updateDomain
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /domains/team/{teamId}/domain/{domainName}
method: delete
operationId: domains-deleteDomain
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /domains/team/{teamId}
method: get
operationId: domains-listDomains
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /domains/team/{teamId}/domain/{domainName}/verify
method: post
operationId: domains-verifyDomain
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /domains/team/{teamId}/domain/{domainName}/workspace-connections
method: put
operationId: domains-updateWorkspaceConnections
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /managed-services/providers
method: get
operationId: managed-services-listProviders
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /managed-services/providers
method: post
operationId: managed-services-createProvider
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /managed-services/providers
method: put
operationId: managed-services-upsertProvider
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /managed-services/providers/{name}/{schemaVersion}
method: delete
operationId: managed-services-deleteProvider
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /managed-services/providers/{name}/{schemaVersion}
method: patch
operationId: managed-services-updateProvider
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /managed-services
method: post
operationId: managed-services-create
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /managed-services
method: get
operationId: managed-services-list
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /managed-services/{id}
method: delete
operationId: managed-services-delete
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /managed-services/{id}
method: get
operationId: managed-services-getDetails
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /managed-services/{id}
method: patch
operationId: managed-services-update
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /managed-services/{id}/backups
method: post
operationId: managed-services-scheduleBackup
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /metadata/datacenters
method: get
operationId: metadata-getDatacenters
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /metadata/workspace-plans
method: get
operationId: metadata-getWorkspacePlans
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /metadata/workspace-base-images
method: get
operationId: metadata-getWorkspaceBaseImages
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /organizations/{organizationId}/members
method: post
operationId: organizations-addOrgMember
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /organizations/{organizationId}/members
method: get
operationId: organizations-listOrgMembers
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /organizations/{organizationId}/members/{userId}/role
method: put
operationId: organizations-changeOrgRole
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /organizations
method: get
operationId: organizations-listOrganizations
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /organizations/{organizationId}/teams
method: get
operationId: organizations-listOrgTeams
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /organizations/{organizationId}/members/{userId}
method: delete
operationId: organizations-removeOrgMember
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /ssh/keys
method: post
operationId: ssh-uploadPublicKey
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /ssh/keys
method: get
operationId: ssh-listPublicKeys
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /ssh/keys
method: delete
operationId: ssh-deletePublicKey
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /teams/{teamId}
method: get
operationId: teams-getTeam
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /teams/{teamId}
method: delete
operationId: teams-deleteTeam
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /teams
method: get
operationId: teams-listTeams
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /teams
method: post
operationId: teams-createTeam
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /teams/{teamId}/migrate
method: post
operationId: teams-migrateTeamToOrg
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /teams/{teamId}/members
method: post
operationId: teams-inviteMember
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /teams/{teamId}/members
method: get
operationId: teams-listMembers
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /teams/{teamId}/members/{userId}/role
method: put
operationId: teams-changeRole
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /teams/{teamId}/members/{userId}
method: delete
operationId: teams-removeMember
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /vault/teams/{teamId}/shared
method: get
operationId: vault-listSharedVaults
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /vault/teams/{teamId}/shared
method: post
operationId: vault-createSharedVault
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /vault/teams/{teamId}/shared/{vaultName}
method: delete
operationId: vault-deleteSharedVault
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /vault/teams/{teamId}/shared/{vaultName}/secrets
method: post
operationId: vault-storeSharedSecrets
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /vault/teams/{teamId}/shared/{vaultName}/secrets
method: delete
operationId: vault-deleteSharedSecrets
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /vault/teams/{teamId}/shared/{vaultName}/generate
method: post
operationId: vault-generateSharedSecrets
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /vault/teams/{teamId}/shared/{vaultName}/keys
method: get
operationId: vault-listSharedSecretKeys
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /vault/teams/{teamId}/workspaces/{workspaceId}
method: post
operationId: vault-storeWorkspaceSecrets
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /vault/teams/{teamId}/workspaces/{workspaceId}
method: delete
operationId: vault-deleteWorkspaceSecrets
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /vault/teams/{teamId}/workspaces/{workspaceId}/keys
method: get
operationId: vault-listWorkspaceSecrets
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /vault/teams/{teamId}/workspaces/{workspaceId}/generate
method: post
operationId: vault-generateSecrets
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}
method: get
operationId: workspaces-getWorkspace
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /workspaces/{workspaceId}
method: patch
operationId: workspaces-updateWorkspace
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}
method: delete
operationId: workspaces-deleteWorkspace
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/status
method: get
operationId: workspaces-getWorkspaceStatus
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /workspaces
method: post
operationId: workspaces-createWorkspace
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/team/{teamId}
method: get
operationId: workspaces-listWorkspaces
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /workspaces/{workspaceId}/landscape/deploy/{profile}
method: post
operationId: workspaces-deployLandscape-1
x-agentic-access:
action-class: acting
consequence: physical
subject: required
audience: null
token:
max-ttl: 300
exchange: true
purpose-required: true
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/landscape/deploy
method: post
operationId: workspaces-deployLandscape
x-agentic-access:
action-class: acting
consequence: physical
subject: required
audience: null
token:
max-ttl: 300
exchange: true
purpose-required: true
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/landscape/teardown
method: delete
operationId: workspaces-teardownLandscape
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/landscape/scale
method: patch
operationId: workspaces-scaleLandscapeServices
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/pipeline/{stage}/start/{profile}
method: post
operationId: workspaces-startPipelineStage-1
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/pipeline/{stage}/start
method: post
operationId: workspaces-startPipelineStage
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/pipeline/{stage}/stop
method: post
operationId: workspaces-stopPipelineStage
x-agentic-access:
action-class: acting
consequence: safety-critical
subject: required
audience: null
token:
max-ttl: 120
exchange: true
purpose-required: true
proof-of-possession: true
escalation:
human-in-the-loop: required
audit: required
- path: /workspaces/{workspaceId}/pipeline/{stage}
method: get
operationId: workspaces-pipelineStatus
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /workspaces/{workspaceId}/env-vars
method: get
operationId: workspaces-listEnvVars
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /workspaces/{workspaceId}/env-vars
method: put
operationId: workspaces-setEnvVar
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/env-vars
method: delete
operationId: workspaces-deleteEnvVar
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/execute
method: post
operationId: workspaces-executeCommand
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/git/head
method: get
operationId: workspaces-gitHead
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /workspaces/{workspaceId}/git/pull/{remote}/{branch}
method: post
operationId: workspaces-gitPull-2
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/git/pull/{remote}
method: post
operationId: workspaces-gitPull-1
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/git/pull
method: post
operationId: workspaces-gitPull
x-agentic-access:
action-class: acting
consequence: write
subject: required
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /workspaces/{workspaceId}/logs/{stage}/{step}
method: get
operationId: workspaces-logs
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /workspaces/{workspaceId}/logs/run/{step}/server/{server}
method: get
operationId: workspaces-serverLogs
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /workspaces/{workspaceId}/logs/run/{step}/replica/{replica}
method: get
operationId: workspaces-replicaLogs
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /usage/teams/{teamId}/resources/landscape-service/summary
method: get
operationId: usage-getUsageSummaryLandscape
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none
- path: /usage/teams/{teamId}/resources/landscape-service/{resourceId}/events
method: get
operationId: usage-getLandscapeServiceEvents
x-agentic-access:
action-class: connected
consequence: read
subject: optional
token:
max-ttl: 3600
audit: none