CUTISS · Agentic Access

CUTISS Agentic Access

x-agentic-access derived

CUTISS exposes 15 API operations that an AI agent could call, of which 0 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.

Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.

CompanyBiotechnologyRegenerative MedicineTissue EngineeringLife SciencesMedical DevicesClinical TrialsDermatologyHealthcareSwitzerlandResearchContent
Operations: 15 Acting: 0 Human-in-the-loop: 0 Method: derived

By consequence

Source

Agentic Access

Raw ↑ 
generated: '2026-08-11'
method: derived
source: openapi/ + conventions/cutiss-conventions.yml
summary: Recommended x-agentic-access posture for the CUTISS content API. Every publicly reachable operation
  is a safe, read-only retrieval of already-public corporate content, so the whole surface classifies
  as low-consequence.
defaults:
  action_class: read
  consequence: none
  token: none
  escalation: not-required
  reversible: true
operations:
- operationId: listNewsroom
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: getNewsroomItem
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: listPosts
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: getPostsItem
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: listPages
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: getPagesItem
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: listTeam
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: getTeamItem
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: listTeams
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: getTeamsItem
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: listMedia
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: getMediaItem
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: listCategories
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: getCategoriesItem
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
- operationId: listSearch
  action_class: read
  consequence: none
  scope: public-content
  token: none
  escalation: not-required
  note: Anonymous GET of published corporate content. No state change, no personal data beyond publicly
    listed staff profiles.
denied:
- surface: all write methods (POST/PUT/PATCH/DELETE)
  reason: 401 rest_forbidden for anonymous callers — an agent cannot and must not attempt them.
- surface: /wp/v2/users, /wp/v2/settings, /wp/v2/plugins, /wp/v2/menus
  reason: Administrative, 401-gated.
- surface: /wp-abilities/v1/*
  reason: Agent ability registry, 401-gated.
agent_guidance:
- Treat this as a corporate content source, not a product API — there is no transactional capability here.
- Cap per_page at 100 and page with X-WP-TotalPages; self-throttle, since no rate limit is published.
- 'Filter by language: parallel English and German records exist with distinct ids and will otherwise
  duplicate.'
- Branch on the error `code` field — messages are returned in German regardless of request locale.
- The team directory contains named individuals; treat it as personal data even though it is publicly
  published.
- This API carries no CUTISS stability commitment; re-validate the shape rather than caching assumptions.