Azure Synapse Analytics · Agentic Access
Azure Synapse Analytics Agentic Access

x-agentic-access generated
Azure Synapse Analytics exposes 160 API operations that an AI agent could call, of which 93 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.
By consequence: 67 read, 87 write, and 6 safety-critical.
6 operations are classed safety-critical and should require human-in-the-loop approval at runtime.
Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.
AnalyticsApache SparkBig DataData IntegrationData WarehouseETLSQL
Operations: 160 Acting: 93 Human-in-the-loop: 6 Method: generated
By consequence

read 67 write 87 safety-critical 6
Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.
Method	Path	Consequence	Human-in-loop
POST	/linkconnections/{linkConnectionName}/stop	safety-critical	required
PUT	/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/kustoPools/{kustoPoolName}	safety-critical	required
PATCH	/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/kustoPools/{kustoPoolName}	safety-critical	required
DELETE	/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/kustoPools/{kustoPoolName}	safety-critical	required
PUT	/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/managedIdentitySqlControlSettings/default	safety-critical	required
POST	/triggers/{triggerName}/stop	safety-critical	required
Source

Agentic Access

generated: '2026-07-15'
method: generated
source: openapi/azure-synapse-analytics-access-control-openapi.yml, openapi/azure-synapse-analytics-azure-ad-only-auth-openapi.yml,
  openapi/azure-synapse-analytics-credential-openapi.yml, openapi/azure-synapse-analytics-data-flow-debug-session-openapi.yml,
  openapi/azure-synapse-analytics-data-flow-openapi.yml, openapi/azure-synapse-analytics-dataset-openapi.yml,
  openapi/azure-synapse-analytics-firewall-rules-openapi.yml, openapi/azure-synapse-analytics-git-integration-openapi.yml,
  openapi/azure-synapse-analytics-integration-runtimes-openapi.yml, openapi/azure-synapse-analytics-keys-openapi.yml,
  openapi/azure-synapse-analytics-kql-script-openapi.yml, openapi/azure-synapse-analytics-kusto-pools-openapi.yml,
  openapi/azure-synapse-analytics-library-openapi.yml, openapi/azure-synapse-analytics-link-connection-openapi.yml,
  openapi/azure-synapse-analytics-linked-service-openapi.yml, openapi/azure-synapse-analytics-managed-private-endpoints-openapi.yml,
  openapi/azure-synapse-analytics-monitoring-openapi.yml, openapi/azure-synapse-analytics-notebook-openapi.yml,
  openapi/azure-synapse-analytics-pipeline-openapi.yml, openapi/azure-synapse-analytics-private-endpoint-connections-openapi.yml,
  openapi/azure-synapse-analytics-private-link-hubs-openapi.yml, openapi/azure-synapse-analytics-spark-configuration-openapi.yml,
  openapi/azure-synapse-analytics-spark-job-definition-openapi.yml, openapi/azure-synapse-analytics-spark-job-openapi.yml,
  openapi/azure-synapse-analytics-spark-pools-openapi.yml, openapi/azure-synapse-analytics-sql-pools-openapi.yml,
  openapi/azure-synapse-analytics-sql-script-openapi.yml, openapi/azure-synapse-analytics-synapse-link-openapi.yml,
  openapi/azure-synapse-analytics-trigger-openapi.yml, openapi/azure-synapse-analytics-workspace-openapi.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 160
  by_action_class:
    connected: 67
    acting: 93
  by_consequence:
    read: 67
    write: 87
    safety-critical: 6
  human_in_the_loop_required: 6
operations:
- path: /roleAssignments
  method: get
  operationId: RoleAssignments_ListRoleAssignments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /roleAssignments/{roleAssignmentId}
  method: get
  operationId: RoleAssignments_GetRoleAssignmentById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /roleAssignments/{roleAssignmentId}
  method: put
  operationId: RoleAssignments_CreateRoleAssignment
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /roleAssignments/{roleAssignmentId}
  method: delete
  operationId: RoleAssignments_DeleteRoleAssignmentById
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/azureADOnlyAuthentications
  method: get
  operationId: AzureADOnlyAuthentications_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/azureADOnlyAuthentications/{azureADOnlyAuthenticationName}
  method: get
  operationId: AzureADOnlyAuthentications_Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/azureADOnlyAuthentications/{azureADOnlyAuthenticationName}
  method: put
  operationId: AzureADOnlyAuthentications_Create
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /credentials
  method: get
  operationId: Credential_GetCredentialsByWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /credentials/{credentialName}
  method: get
  operationId: Credential_GetCredential
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /credentials/{credentialName}
  method: put
  operationId: Credential_CreateOrUpdateCredential
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /credentials/{credentialName}
  method: delete
  operationId: Credential_DeleteCredential
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /credentials/{credentialName}/rename
  method: post
  operationId: Credential_RenameCredential
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /queryDataFlowDebugSessions
  method: post
  operationId: DataFlowDebugSession_QueryDataFlowDebugSessionsByWorkspace
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /createDataFlowDebugSession
  method: post
  operationId: DataFlowDebugSession_CreateDataFlowDebugSession
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /addDataFlowToDebugSession
  method: post
  operationId: DataFlowDebugSession_AddDataFlow
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /deleteDataFlowDebugSession
  method: post
  operationId: DataFlowDebugSession_DeleteDataFlowDebugSession
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /executeDataFlowDebugCommand
  method: post
  operationId: DataFlowDebugSession_ExecuteCommand
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /dataflows
  method: get
  operationId: DataFlow_GetDataFlowsByWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /dataflows/{dataFlowName}
  method: get
  operationId: DataFlow_GetDataFlow
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /dataflows/{dataFlowName}
  method: put
  operationId: DataFlow_CreateOrUpdateDataFlow
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /dataflows/{dataFlowName}
  method: delete
  operationId: DataFlow_DeleteDataFlow
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /dataflows/{dataFlowName}/rename
  method: post
  operationId: DataFlow_RenameDataFlow
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /datasets
  method: get
  operationId: Dataset_GetDatasetsByWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /datasets/{datasetName}
  method: get
  operationId: Dataset_GetDataset
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /datasets/{datasetName}
  method: put
  operationId: Dataset_CreateOrUpdateDataset
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /datasets/{datasetName}
  method: delete
  operationId: Dataset_DeleteDataset
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /datasets/{datasetName}/rename
  method: post
  operationId: Dataset_RenameDataset
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/firewallRules
  method: get
  operationId: IpFirewallRules_ListByWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/firewallRules/{ruleName}
  method: get
  operationId: IpFirewallRules_Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/firewallRules/{ruleName}
  method: put
  operationId: IpFirewallRules_CreateOrUpdate
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/firewallRules/{ruleName}
  method: delete
  operationId: IpFirewallRules_Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/replaceAllIpFirewallRules
  method: post
  operationId: IpFirewallRules_ReplaceAll
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /getGitHubAccessToken
  method: post
  operationId: WorkspaceGitRepoManagement_GetGitHubAccessToken
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /integrationRuntimes
  method: get
  operationId: IntegrationRuntimes_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /integrationRuntimes/{integrationRuntimeName}
  method: get
  operationId: IntegrationRuntimes_Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/keys
  method: get
  operationId: Keys_ListByWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/keys/{keyName}
  method: get
  operationId: Keys_Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/keys/{keyName}
  method: put
  operationId: Keys_CreateOrUpdate
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/keys/{keyName}
  method: delete
  operationId: Keys_Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /kqlScripts
  method: get
  operationId: KqlScripts_GetAll
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /kqlScripts/{kqlScriptName}
  method: get
  operationId: KqlScript_GetByName
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /kqlScripts/{kqlScriptName}
  method: put
  operationId: KqlScript_CreateOrUpdate
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /kqlScripts/{kqlScriptName}
  method: delete
  operationId: KqlScript_DeleteByName
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /kqlScripts/{kqlScriptName}/rename
  method: post
  operationId: KqlScript_Rename
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/kustoPools
  method: get
  operationId: KustoPools_ListByWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/kustoPools/{kustoPoolName}
  method: get
  operationId: KustoPools_Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/kustoPools/{kustoPoolName}
  method: put
  operationId: KustoPools_CreateOrUpdate
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/kustoPools/{kustoPoolName}
  method: patch
  operationId: KustoPools_Update
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
    scope:
    - user_impersonation
- path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/kustoPools/{kustoPoolName}
  method: delete
  operationId: KustoPools_Delete
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
    scope:
    - user_impersonation
- path: /libraries
  method: get
  operationId: Library_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /libraries/{libraryName}
  method: get
  operationId: Library_Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /libraries/{libraryName}
  method: put
  operationId: Library_Append
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /libraries/{libraryName}
  method: delete
  operationId: Library_Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /libraries/{libraryName}/flush
  method: post
  operationId: Library_Flush
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /linkconnections
  method: get
  operationId: LinkConnection_ListByWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /linkconnections/{linkConnectionName}
  method: get
  operationId: LinkConnection_Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /linkconnections/{linkConnectionName}
  method: put
  operationId: LinkConnection_CreateOrUpdate
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /linkconnections/{linkConnectionName}
  method: delete
  operationId: LinkConnection_Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /linkconnections/{linkConnectionName}/start
  method: post
  operationId: LinkConnection_Start
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /linkconnections/{linkConnectionName}/stop
  method: post
  operationId: LinkConnection_Stop
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
    scope:
    - user_impersonation
- path: /linkconnections/{linkConnectionName}/detailedstatus
  method: get
  operationId: LinkConnection_GetDetailedStatus
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /linkconnections/{linkConnectionName}/linktables
  method: get
  operationId: LinkConnection_ListLinkTables
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /linkedservices
  method: get
  operationId: LinkedService_GetLinkedServicesByWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /linkedservices/{linkedServiceName}
  method: get
  operationId: LinkedService_GetLinkedService
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /linkedservices/{linkedServiceName}
  method: put
  operationId: LinkedService_CreateOrUpdateLinkedService
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /linkedservices/{linkedServiceName}
  method: delete
  operationId: LinkedService_DeleteLinkedService
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /linkedservices/{linkedServiceName}/rename
  method: post
  operationId: LinkedService_RenameLinkedService
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /managedVirtualNetworks/{managedVirtualNetworkName}/managedPrivateEndpoints
  method: get
  operationId: ManagedPrivateEndpoints_List
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /managedVirtualNetworks/{managedVirtualNetworkName}/managedPrivateEndpoints/{managedPrivateEndpointName}
  method: get
  operationId: ManagedPrivateEndpoints_Get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /managedVirtualNetworks/{managedVirtualNetworkName}/managedPrivateEndpoints/{managedPrivateEndpointName}
  method: put
  operationId: ManagedPrivateEndpoints_Create
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /managedVirtualNetworks/{managedVirtualNetworkName}/managedPrivateEndpoints/{managedPrivateEndpointName}
  method: delete
  operationId: ManagedPrivateEndpoints_Delete
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /monitoring/workloadTypes/spark/Applications
  method: get
  operationId: Monitoring_GetSparkJobList
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /monitoring/workloadTypes/sql/querystring
  method: get
  operationId: Monitoring_GetSqlJobQueryString
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /notebooks
  method: get
  operationId: Notebook_GetNotebooksByWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /notebooks/summary
  method: get
  operationId: Notebook_GetNotebookSummaryByWorkSpace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /notebooks/{notebookName}
  method: get
  operationId: Notebook_GetNotebook
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /notebooks/{notebookName}
  method: put
  operationId: Notebook_CreateOrUpdateNotebook
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /notebooks/{notebookName}
  method: delete
  operationId: Notebook_DeleteNotebook
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /notebooks/{notebookName}/rename
  method: post
  operationId: Notebook_RenameNotebook
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /pipelines
  method: get
  operationId: Pipeline_GetPipelinesByWorkspace
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /pipelines/{pipelineName}
  method: get
  operationId: Pipeline_GetPipeline
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - user_impersonation
- path: /pipelines/{pipelineName}
  method: put
  operationId: Pipeline_CreateOrUpdatePipeline
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - user_impersonation
- path: /pipelines/{pipelineName}
  method: delete
  operationId: Pipeline_DeletePipeline
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - hi

# --- truncated at 32 KB (63 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-azure-synapse-analytics/refs/heads/main/agentic-access/microsoft-azure-synapse-analytics-agentic-access.yml