ConductorOne · Agentic Access
ConductorOne Agentic Access

x-agentic-access generated
ConductorOne exposes 243 API operations that an AI agent could call, of which 164 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.
By consequence: 79 read, 156 write, 2 physical, and 6 safety-critical.
6 operations are classed safety-critical and should require human-in-the-loop approval at runtime.
Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.
CompanyCloud SaasIdentity SecurityAccess GovernanceIdentity and Access ManagementAccess ReviewsProvisioningLeast PrivilegeMCP GovernanceSecurity
Operations: 243 Acting: 164 Human-in-the-loop: 6 Method: generated
By consequence

read 79 write 156 physical 2 safety-critical 6
Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.
Method	Path	Consequence	Human-in-loop
POST	/api/v1/apps/{app_id}/connectors/{connector_id}/credentials/{id}	safety-critical	required
POST	/api/v1/apps/{app_id}/usage_controls	safety-critical	required
POST	/api/v1/automation_executions/{id}/actions/terminate	safety-critical	required
POST	/api/v1/task/revoke	safety-critical	required
POST	/api/v1/tasks/{task_id}/action/escalate	safety-critical	required
POST	/api/v1/tasks/{task_id}/action/reset	safety-critical	required
DELETE	/api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/remove-membership	physical	conditional
POST	/api/v1/policies/test-account-provision-policy	physical	conditional
Source

Agentic Access

generated: '2026-07-18'
method: generated
source: openapi/conductorone-openapi-original.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 243
  by_action_class:
    acting: 164
    connected: 79
  by_consequence:
    write: 156
    read: 79
    safety-critical: 6
    physical: 2
  human_in_the_loop_required: 6
operations:
- path: /api/v1/accessconflict
  method: post
  operationId: c1.api.accessconflict.v1.AccessConflictService.CreateMonitor
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/accessconflict/{id}
  method: delete
  operationId: c1.api.accessconflict.v1.AccessConflictService.DeleteMonitor
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/accessconflict/{id}
  method: get
  operationId: c1.api.accessconflict.v1.AccessConflictService.GetMonitor
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/accessconflict/{id}
  method: post
  operationId: c1.api.accessconflict.v1.AccessConflictService.UpdateMonitor
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/appentitlementmonitorbinding
  method: delete
  operationId: c1.api.accessconflict.v1.AppEntitlementMonitorBindingService.DeleteAppEntitlementMonitorBinding
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/appentitlementmonitorbinding
  method: post
  operationId: c1.api.accessconflict.v1.AppEntitlementMonitorBindingService.CreateAppEntitlementMonitorBinding
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/appentitlementmonitorbinding/get
  method: post
  operationId: c1.api.accessconflict.v1.AppEntitlementMonitorBindingService.GetAppEntitlementMonitorBinding
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps
  method: get
  operationId: c1.api.app.v1.Apps.List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps
  method: post
  operationId: c1.api.app.v1.Apps.Create
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/access_request_defaults
  method: get
  operationId: c1.api.app.v1.AppAccessRequestsDefaultsService.GetAppAccessRequestsDefaults
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/access_request_defaults
  method: post
  operationId: c1.api.app.v1.AppAccessRequestsDefaultsService.CreateAppAccessRequestsDefaults
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/access_request_defaults/cancel
  method: post
  operationId: c1.api.app.v1.AppAccessRequestsDefaultsService.CancelAppAccessRequestsDefaults
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/app_users
  method: get
  operationId: c1.api.app.v1.AppUserService.List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/app_users/{app_user_id}/credentials
  method: get
  operationId: c1.api.app.v1.AppUserService.ListAppUserCredentials
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/connectors
  method: get
  operationId: c1.api.app.v1.ConnectorService.List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/connectors
  method: post
  operationId: c1.api.app.v1.ConnectorService.CreateDelegated
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/connectors/{connector_id}/confirm_sync_valid/{sync_lifecycle_id}
  method: post
  operationId: c1.api.app.v1.ConnectorService.ConfirmSyncValid
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/connectors/{connector_id}/credentials/{id}
  method: get
  operationId: c1.api.app.v1.ConnectorService.GetCredentials
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/connectors/{connector_id}/credentials/{id}
  method: post
  operationId: c1.api.app.v1.ConnectorService.RevokeCredential
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /api/v1/apps/{app_id}/connectors/{connector_id}/force_sync
  method: post
  operationId: c1.api.app.v1.ConnectorService.ForceSync
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/connectors/{connector_id}/pause
  method: post
  operationId: c1.api.app.v1.ConnectorService.PauseSync
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/connectors/{connector_id}/resume
  method: post
  operationId: c1.api.app.v1.ConnectorService.ResumeSync
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/connectors/{id}
  method: delete
  operationId: c1.api.app.v1.ConnectorService.Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/connectors/{id}
  method: get
  operationId: c1.api.app.v1.ConnectorService.Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/connectors/{id}
  method: post
  operationId: c1.api.app.v1.ConnectorService.Update
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/connectors/create
  method: post
  operationId: c1.api.app.v1.ConnectorService.Create
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements
  method: get
  operationId: c1.api.app.v1.AppEntitlements.List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/entitlements
  method: post
  operationId: c1.api.app.v1.AppEntitlements.Create
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/add-manual-user
  method: post
  operationId: c1.api.app.v1.AppEntitlements.AddManuallyManagedMembers
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/automation
  method: delete
  operationId: c1.api.app.v1.AppEntitlements.DeleteAutomation
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/automation
  method: get
  operationId: c1.api.app.v1.AppEntitlements.GetAutomation
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/automation/create
  method: post
  operationId: c1.api.app.v1.AppEntitlements.CreateAutomation
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/automation/exclusions
  method: delete
  operationId: c1.api.app.v1.AppEntitlements.RemoveAutomationExclusion
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/automation/exclusions
  method: get
  operationId: c1.api.app.v1.AppEntitlements.ListAutomationExclusions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/automation/exclusions
  method: post
  operationId: c1.api.app.v1.AppEntitlements.AddAutomationExclusion
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/automation/update
  method: post
  operationId: c1.api.app.v1.AppEntitlements.UpdateAutomation
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/grants
  method: get
  operationId: c1.api.app.v1.AppEntitlementSearchService.SearchAppEntitlementsWithExpired
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/remove-membership
  method: delete
  operationId: c1.api.app.v1.AppEntitlements.RemoveEntitlementMembership
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/users
  method: get
  operationId: c1.api.app.v1.AppEntitlements.ListUsers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/users/{app_user_id}/remove-grant-duration
  method: post
  operationId: c1.api.app.v1.AppEntitlementUserBindingService.RemoveGrantDuration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/users/{app_user_id}/update-grant-duration
  method: post
  operationId: c1.api.app.v1.AppEntitlementUserBindingService.UpdateGrantDuration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{app_entitlement_id}/users/{identity_user_id}/grants
  method: get
  operationId: c1.api.app.v1.AppEntitlementUserBindingService.ListAppUsersForIdentityWithGrant
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/entitlements/{entitlement_id}/ownerids
  method: get
  operationId: c1.api.app.v1.AppEntitlementOwners.ListOwnerIDs
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/entitlements/{entitlement_id}/owners
  method: delete
  operationId: c1.api.app.v1.AppEntitlementOwners.Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{entitlement_id}/owners
  method: get
  operationId: c1.api.app.v1.AppEntitlementOwners.List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/entitlements/{entitlement_id}/owners
  method: post
  operationId: c1.api.app.v1.AppEntitlementOwners.Add
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{entitlement_id}/owners
  method: put
  operationId: c1.api.app.v1.AppEntitlementOwners.Set
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{entitlement_id}/owners/{user_id}
  method: delete
  operationId: c1.api.app.v1.AppEntitlementOwners.Remove
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{id}
  method: delete
  operationId: c1.api.app.v1.AppEntitlements.Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/{id}
  method: get
  operationId: c1.api.app.v1.AppEntitlements.Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/entitlements/{id}
  method: post
  operationId: c1.api.app.v1.AppEntitlements.Update
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/entitlements/resource_types/{app_resource_type_id}/resources/{app_resource_id}
  method: get
  operationId: c1.api.app.v1.AppEntitlements.ListForAppResource
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/entitlements/users/{app_user_id}
  method: get
  operationId: c1.api.app.v1.AppEntitlements.ListForAppUser
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/ownerids
  method: get
  operationId: c1.api.app.v1.AppOwners.ListOwnerIDs
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/owners
  method: delete
  operationId: c1.api.app.v1.AppOwners.Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/owners
  method: get
  operationId: c1.api.app.v1.AppOwners.List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/owners
  method: put
  operationId: c1.api.app.v1.AppOwners.Set
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/owners/{user_id}
  method: delete
  operationId: c1.api.app.v1.AppOwners.Remove
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/owners/{user_id}
  method: post
  operationId: c1.api.app.v1.AppOwners.Add
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/report
  method: get
  operationId: c1.api.app.v1.AppReportService.List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/report
  method: post
  operationId: c1.api.app.v1.AppReportActionService.GenerateReport
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/resource_types
  method: get
  operationId: c1.api.app.v1.AppResourceTypeService.List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/resource_types
  method: post
  operationId: c1.api.app.v1.AppResourceTypeService.CreateManuallyManagedResourceType
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/resource_types/{app_resource_type_id}/resources
  method: get
  operationId: c1.api.app.v1.AppResourceService.List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/resource_types/{app_resource_type_id}/resources
  method: post
  operationId: c1.api.app.v1.AppResourceService.CreateManuallyManagedAppResource
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/resource_types/{app_resource_type_id}/resources/{id}
  method: delete
  operationId: c1.api.app.v1.AppResourceService.DeleteManuallyManagedAppResource
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/resource_types/{app_resource_type_id}/resources/{id}
  method: get
  operationId: c1.api.app.v1.AppResourceService.Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/resource_types/{app_resource_type_id}/resources/{id}
  method: post
  operationId: c1.api.app.v1.AppResourceService.Update
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/resource_types/{id}
  method: delete
  operationId: c1.api.app.v1.AppResourceTypeService.DeleteManuallyManagedResourceType
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/resource_types/{id}
  method: get
  operationId: c1.api.app.v1.AppResourceTypeService.Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/resource_types/{id}
  method: post
  operationId: c1.api.app.v1.AppResourceTypeService.UpdateManuallyManagedResourceType
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/resource_types/{resource_type_id}/resource/{resource_id}/ownerids
  method: delete
  operationId: c1.api.app.v1.AppResourceOwners.Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/resource_types/{resource_type_id}/resource/{resource_id}/ownerids
  method: get
  operationId: c1.api.app.v1.AppResourceOwners.ListOwnerIDs
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/resource_types/{resource_type_id}/resource/{resource_id}/owners
  method: delete
  operationId: c1.api.app.v1.AppResourceOwners.Remove
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/resource_types/{resource_type_id}/resource/{resource_id}/owners
  method: get
  operationId: c1.api.app.v1.AppResourceOwners.List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/resource_types/{resource_type_id}/resource/{resource_id}/owners
  method: post
  operationId: c1.api.app.v1.AppResourceOwners.Add
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/resource_types/{resource_type_id}/resource/{resource_id}/owners
  method: put
  operationId: c1.api.app.v1.AppResourceOwners.Set
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{app_id}/usage_controls
  method: get
  operationId: c1.api.app.v1.AppUsageControlsService.Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_id}/usage_controls
  method: post
  operationId: c1.api.app.v1.AppUsageControlsService.Update
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /api/v1/apps/{app_id}/users/{user_id}/app_users
  method: get
  operationId: c1.api.app.v1.AppUserService.ListAppUsersForUser
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{app_user_app_id}/app_users/{app_user_id}
  method: post
  operationId: c1.api.app.v1.AppUserService.Update
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{connector_app_id}/connectors/{connector_id}/delegated
  method: post
  operationId: c1.api.app.v1.ConnectorService.UpdateDelegated
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{id}
  method: delete
  operationId: c1.api.app.v1.Apps.Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{id}
  method: get
  operationId: c1.api.app.v1.Apps.Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{id}
  method: post
  operationId: c1.api.app.v1.Apps.Update
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{src_app_id}/{src_app_entitlement_id}/bindings/{dst_app_id}/{dst_app_entitlement_id}
  method: delete
  operationId: c1.api.app.v1.AppEntitlementsProxy.Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/{src_app_id}/{src_app_entitlement_id}/bindings/{dst_app_id}/{dst_app_entitlement_id}
  method: get
  operationId: c1.api.app.v1.AppEntitlementsProxy.Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /api/v1/apps/{src_app_id}/{src_app_entitlement_id}/bindings/{dst_app_id}/{dst_app_entitlement_id}
  method: post
  operationId: c1.api.app.v1.AppEntitlementsProxy.Create
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/connectors/credentials
  method: post
  operationId: c1.api.app.v1.ConnectorService.RotateCredential
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /api/v1/apps/connectors/validate_config/http
  method: post
  operationId: c1.api.app.v1.ConnectorService.ValidateHTTPConnectorConfig
 

# --- truncated at 32 KB (84 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/conductorone/refs/heads/main/agentic-access/conductorone-agentic-access.yml