Microsoft Azure Functions · Agentic Access

Microsoft Azure Functions Agentic Access

x-agentic-access generated

Microsoft Azure Functions exposes 692 API operations that an AI agent could call, of which 353 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.

By consequence: 339 read, 253 write, 68 physical, and 32 safety-critical.

32 operations are classed safety-critical and should require human-in-the-loop approval at runtime.

Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.

AzureCloudComputeEvent-DrivenMicrosoftServerless
Operations: 692 Acting: 353 Human-in-the-loop: 32 Method: generated

By consequence

read 339 write 253 physical 68 safety-critical 32

Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.

MethodPathConsequenceHuman-in-loop
PUT /providers/Microsoft.Web/sourcecontrols/{sourceControlType} safety-critical required
POST /subscriptions/{subscriptionId}/providers/Microsoft.Web/recommendations/reset safety-critical required
POST /subscriptions/{subscriptionId}/providers/Microsoft.Web/recommendations/{name}/disable safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{hostingEnvironmentName}/recommendations/disable safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{hostingEnvironmentName}/recommendations/reset safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{hostingEnvironmentName}/recommendations/{name}/disable safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/reboot safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/continuouswebjobs/{webJobName}/stop safety-critical required
DELETE /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/instances/{instanceId}/processes/{processId} safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/networkTrace/stop safety-critical required
DELETE /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/processes/{processId} safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/resetSlotConfig safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/continuouswebjobs/{webJobName}/stop safety-critical required
DELETE /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/instances/{instanceId}/processes/{processId} safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/networkTrace/stop safety-critical required
DELETE /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/processes/{processId} safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/resetSlotConfig safety-critical required
PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/sourcecontrols/web safety-critical required
PATCH /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/sourcecontrols/web safety-critical required
DELETE /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/sourcecontrols/web safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/stop safety-critical required
POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/stopNetworkTrace safety-critical required
PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/sourcecontrols/web safety-critical required
PATCH /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/sourcecontrols/web safety-critical required
DELETE /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/sourcecontrols/web safety-critical required

Source

Agentic Access

Raw ↑ 
generated: '2026-07-15'
method: generated
source: openapi/azure-functions-management-api.json
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 692
  by_action_class:
    connected: 339
    acting: 353
  by_consequence:
    read: 339
    write: 253
    safety-critical: 32
    physical: 68
  human_in_the_loop_required: 32
operations:
- path: /providers/Microsoft.Web/availableStacks
  method: get
  operationId: Provider_GetAvailableStacks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /providers/Microsoft.Web/functionAppStacks
  method: get
  operationId: Provider_GetFunctionAppStacks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /providers/Microsoft.Web/locations/{location}/functionAppStacks
  method: get
  operationId: Provider_GetFunctionAppStacksForLocation
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /providers/Microsoft.Web/locations/{location}/webAppStacks
  method: get
  operationId: Provider_GetWebAppStacksForLocation
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /providers/Microsoft.Web/operations
  method: get
  operationId: Provider_ListOperations
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /providers/Microsoft.Web/publishingUsers/web
  method: get
  operationId: GetPublishingUser
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /providers/Microsoft.Web/publishingUsers/web
  method: put
  operationId: UpdatePublishingUser
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /providers/Microsoft.Web/sourcecontrols
  method: get
  operationId: ListSourceControls
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /providers/Microsoft.Web/sourcecontrols/{sourceControlType}
  method: get
  operationId: GetSourceControl
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /providers/Microsoft.Web/sourcecontrols/{sourceControlType}
  method: put
  operationId: UpdateSourceControl
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
    scope:
    - user_impersonation
- path: /providers/Microsoft.Web/webAppStacks
  method: get
  operationId: Provider_GetWebAppStacks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/aseRegions
  method: get
  operationId: ListAseRegions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/availableStacks
  method: get
  operationId: Provider_GetAvailableStacksOnPrem
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/billingMeters
  method: get
  operationId: ListBillingMeters
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/certificates
  method: get
  operationId: Certificates_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/checknameavailability
  method: post
  operationId: CheckNameAvailability
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/customhostnameSites
  method: get
  operationId: ListCustomHostNameSites
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/deletedSites
  method: get
  operationId: DeletedWebApps_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/deletedSites/{deletedSiteId}
  method: get
  operationId: Global_GetDeletedWebApp
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/deletedSites/{deletedSiteId}/snapshots
  method: get
  operationId: Global_GetDeletedWebAppSnapshots
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/deploymentLocations
  method: get
  operationId: GetSubscriptionDeploymentLocations
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/geoRegions
  method: get
  operationId: ListGeoRegions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/hostingEnvironments
  method: get
  operationId: AppServiceEnvironments_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/kubeEnvironments
  method: get
  operationId: KubeEnvironments_ListBySubscription
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/listSitesAssignedToHostName
  method: post
  operationId: ListSiteIdentifiersAssignedToHostName
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/locations/{location}/checknameavailability
  method: post
  operationId: RegionalCheckNameAvailability
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/locations/{location}/deletedSites
  method: get
  operationId: DeletedWebApps_ListByLocation
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/locations/{location}/deletedSites/{deletedSiteId}
  method: get
  operationId: DeletedWebApps_GetDeletedWebAppByLocation
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/locations/{location}/operations/{operationId}
  method: get
  operationId: Global_GetSubscriptionOperationWithAsyncResponse
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/locations/{location}/previewStaticSiteWorkflowFile
  method: post
  operationId: StaticSites_PreviewWorkflow
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/locations/{location}/usages
  method: get
  operationId: GetUsagesInLocation_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/premieraddonoffers
  method: get
  operationId: ListPremierAddOnOffers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/recommendations
  method: get
  operationId: Recommendations_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/recommendations/{name}/disable
  method: post
  operationId: Recommendations_DisableRecommendationForSubscription
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/recommendations/reset
  method: post
  operationId: Recommendations_ResetAllFilters
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/resourceHealthMetadata
  method: get
  operationId: ResourceHealthMetadata_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/serverfarms
  method: get
  operationId: AppServicePlans_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/sites
  method: get
  operationId: WebApps_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/skus
  method: get
  operationId: ListSkus
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/staticSites
  method: get
  operationId: StaticSites_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/providers/Microsoft.Web/verifyHostingEnvironmentVnet
  method: post
  operationId: VerifyHostingEnvironmentVnet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/moveResources
  method: post
  operationId: Move
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/certificates
  method: get
  operationId: Certificates_ListByResourceGroup
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/certificates/{name}
  method: get
  operationId: Certificates_Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/certificates/{name}
  method: put
  operationId: Certificates_CreateOrUpdate
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/certificates/{name}
  method: patch
  operationId: Certificates_Update
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/certificates/{name}
  method: delete
  operationId: Certificates_Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments
  method: get
  operationId: AppServiceEnvironments_ListByResourceGroup
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}
  method: get
  operationId: AppServiceEnvironments_Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}
  method: put
  operationId: AppServiceEnvironments_CreateOrUpdate
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}
  method: patch
  operationId: AppServiceEnvironments_Update
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}
  method: delete
  operationId: AppServiceEnvironments_Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/capacities/compute
  method: get
  operationId: AppServiceEnvironments_ListCapacities
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/capacities/virtualip
  method: get
  operationId: AppServiceEnvironments_GetVipInfo
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/changeVirtualNetwork
  method: post
  operationId: AppServiceEnvironments_ChangeVnet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/configurations/customdnssuffix
  method: get
  operationId: AppServiceEnvironments_GetAseCustomDnsSuffixConfiguration
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/configurations/customdnssuffix
  method: put
  operationId: AppServiceEnvironments_UpdateAseCustomDnsSuffixConfiguration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/configurations/customdnssuffix
  method: delete
  operationId: AppServiceEnvironments_DeleteAseCustomDnsSuffixConfiguration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/configurations/networking
  method: get
  operationId: AppServiceEnvironments_GetAseV3NetworkingConfiguration
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/configurations/networking
  method: put
  operationId: AppServiceEnvironments_UpdateAseNetworkingConfiguration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/detectors
  method: get
  operationId: Diagnostics_ListHostingEnvironmentDetectorResponses
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/detectors/{detectorName}
  method: get
  operationId: Diagnostics_GetHostingEnvironmentDetectorResponse
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/diagnostics
  method: get
  operationId: AppServiceEnvironments_ListDiagnostics
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/inboundNetworkDependenciesEndpoints
  method: get
  operationId: AppServiceEnvironments_GetInboundNetworkDependenciesEndpoints
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/multiRolePools
  method: get
  operationId: AppServiceEnvironments_ListMultiRolePools
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/multiRolePools/default
  method: get
  operationId: AppServiceEnvironments_GetMultiRolePool
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/multiRolePools/default
  method: put
  operationId: AppServiceEnvironments_CreateOrUpdateMultiRolePool
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/multiRolePools/default
  method: patch
  operationId: AppServiceEnvironments_UpdateMultiRolePool
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/multiRolePools/default/metricdefinitions
  method: get
  operationId: AppServiceEnvironments_ListMultiRoleMetricDefinitions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/multiRolePools/default/skus
  method: get
  operationId: AppServiceEnvironments_ListMultiRolePoolSkus
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/multiRolePools/default/usages
  method: get
  operationId: AppServiceEnvironments_ListMultiRoleUsages
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/operations
  method: get
  operationId: AppServiceEnvironments_ListOperations
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/outboundNetworkDependenciesEndpoints
  method: get
  operationId: AppServiceEnvironments_GetOutboundNetworkDependenciesEndpoints
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/privateEndpointConnections
  method: get
  operationId: AppServiceEnvironments_GetPrivateEndpointConnectionList
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/privateEndpointConnections/{privateEndpointConnectionName}
  method: get
  operationId: AppServiceEnvironments_GetPrivateEndpointConnection
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/privateEndpointConnections/{privateEndpointConnectionName}
  method: put
  operationId: AppServiceEnvironments_ApproveOrRejectPrivateEndpointConnection
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/privateEndpointConnections/{privateEndpointConnectionName}
  method: delete
  operationId: AppServiceEnvironments_DeletePrivateEndpointConnection
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/privateLinkResources
  method: get
  operationId: AppServiceEnvironments_GetPrivateLinkResources
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{name}/reboot
  method: post
  operationId: AppServiceEnvironments_Reboot
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{hostingEnvironmentName}/recommendationHistory
  method: get
  operationId: Recommendations_ListHistoryForHostingEnvironment
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{hostingEnvironmentName}/recommendations
  method: get
  operationId: Recommendations_ListRecommendedRulesForHostingEnvironment
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{hostingEnvironmentName}/recommendations/{name}
  method: get
  operationId: Recommendations_GetRuleDetailsByHostingEnvironment
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/{hosti

# --- truncated at 32 KB (308 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-azure-functions/refs/heads/main/agentic-access/microsoft-azure-functions-agentic-access.yml