NGINX · Agentic Access
NGINX Agentic Access

x-agentic-access generated
NGINX exposes 72 API operations that an AI agent could call, of which 29 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.
By consequence: 43 read, 12 write, and 17 safety-critical.
17 operations are classed safety-critical and should require human-in-the-loop approval at runtime.
Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.
API GatewayCachingCloud NativeLoad BalancerOpen SourceReverse ProxyWeb Server
Operations: 72 Acting: 29 Human-in-the-loop: 17 Method: generated
By consequence

read 43 write 12 safety-critical 17
Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.
Method	Path	Consequence	Human-in-loop
DELETE	/connections	safety-critical	required
DELETE	/http/caches/{httpCacheZoneName}	safety-critical	required
DELETE	/http/limit_conns/{httpLimitConnZoneName}	safety-critical	required
DELETE	/http/limit_reqs/{httpLimitReqZoneName}	safety-critical	required
DELETE	/http/location_zones/{httpLocationZoneName}	safety-critical	required
DELETE	/http/requests	safety-critical	required
DELETE	/http/server_zones/{httpServerZoneName}	safety-critical	required
DELETE	/http/upstreams/{httpUpstreamName}/	safety-critical	required
DELETE	/processes	safety-critical	required
DELETE	/resolvers/{resolverZoneName}	safety-critical	required
DELETE	/slabs/{slabZoneName}	safety-critical	required
DELETE	/ssl	safety-critical	required
DELETE	/stream/limit_conns/{streamLimitConnZoneName}	safety-critical	required
DELETE	/stream/server_zones/{streamServerZoneName}	safety-critical	required
DELETE	/stream/upstreams/{streamUpstreamName}/	safety-critical	required
DELETE	/workers/	safety-critical	required
DELETE	/workers/{workerId}	safety-critical	required
Source

Agentic Access

generated: '2026-07-15'
method: generated
source: openapi/nginx-plus-http-api-openapi.yaml, openapi/nginx-stub-status-openapi.yaml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 72
  by_action_class:
    connected: 43
    acting: 29
  by_consequence:
    read: 43
    safety-critical: 17
    write: 12
  human_in_the_loop_required: 17
operations:
- path: /
  method: get
  operationId: getAPIEndpoints
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /nginx
  method: get
  operationId: getNginx
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /processes
  method: get
  operationId: getProcesses
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /processes
  method: delete
  operationId: deleteProcesses
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /connections
  method: get
  operationId: getConnections
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /connections
  method: delete
  operationId: deleteConnections
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /slabs/
  method: get
  operationId: getSlabs
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /slabs/{slabZoneName}
  method: get
  operationId: getSlabZone
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /slabs/{slabZoneName}
  method: delete
  operationId: deleteSlabZoneStats
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /http/
  method: get
  operationId: getHttp
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/requests
  method: get
  operationId: getHttpRequests
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/requests
  method: delete
  operationId: deleteHttpRequests
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /http/server_zones/
  method: get
  operationId: getHttpServerZones
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/server_zones/{httpServerZoneName}
  method: get
  operationId: getHttpServerZone
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/server_zones/{httpServerZoneName}
  method: delete
  operationId: deleteHttpServerZoneStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /http/location_zones/
  method: get
  operationId: getHttpLocationZones
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/location_zones/{httpLocationZoneName}
  method: get
  operationId: getHttpLocationZone
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/location_zones/{httpLocationZoneName}
  method: delete
  operationId: deleteHttpLocationZoneStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /http/caches/
  method: get
  operationId: getHttpCaches
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/caches/{httpCacheZoneName}
  method: get
  operationId: getHttpCacheZone
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/caches/{httpCacheZoneName}
  method: delete
  operationId: deleteHttpCacheZoneStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /http/limit_conns/
  method: get
  operationId: getHttpLimitConnZones
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/limit_conns/{httpLimitConnZoneName}
  method: get
  operationId: getHttpLimitConnZone
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/limit_conns/{httpLimitConnZoneName}
  method: delete
  operationId: deleteHttpLimitConnZoneStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /http/limit_reqs/
  method: get
  operationId: getHttpLimitReqZones
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/limit_reqs/{httpLimitReqZoneName}
  method: get
  operationId: getHttpLimitReqZone
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/limit_reqs/{httpLimitReqZoneName}
  method: delete
  operationId: deleteHttpLimitReqZoneStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /http/upstreams/
  method: get
  operationId: getHttpUpstreams
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/upstreams/{httpUpstreamName}/
  method: get
  operationId: getHttpUpstreamName
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/upstreams/{httpUpstreamName}/
  method: delete
  operationId: deleteHttpUpstreamStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /http/upstreams/{httpUpstreamName}/servers/
  method: get
  operationId: getHttpUpstreamServers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/upstreams/{httpUpstreamName}/servers/
  method: post
  operationId: postHttpUpstreamServer
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /http/upstreams/{httpUpstreamName}/servers/{httpUpstreamServerId}
  method: get
  operationId: getHttpUpstreamPeer
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/upstreams/{httpUpstreamName}/servers/{httpUpstreamServerId}
  method: patch
  operationId: patchHttpUpstreamPeer
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /http/upstreams/{httpUpstreamName}/servers/{httpUpstreamServerId}
  method: delete
  operationId: deleteHttpUpstreamServer
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /http/keyvals/
  method: get
  operationId: getHttpKeyvalZones
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/keyvals/{httpKeyvalZoneName}
  method: get
  operationId: getHttpKeyvalZoneKeysValues
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /http/keyvals/{httpKeyvalZoneName}
  method: post
  operationId: postHttpKeyvalZoneData
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /http/keyvals/{httpKeyvalZoneName}
  method: patch
  operationId: patchHttpKeyvalZoneKeyValue
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /http/keyvals/{httpKeyvalZoneName}
  method: delete
  operationId: deleteHttpKeyvalZoneData
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /stream/
  method: get
  operationId: getStream
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/server_zones/
  method: get
  operationId: getStreamServerZones
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/server_zones/{streamServerZoneName}
  method: get
  operationId: getStreamServerZone
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/server_zones/{streamServerZoneName}
  method: delete
  operationId: deleteStreamServerZoneStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /stream/limit_conns/
  method: get
  operationId: getStreamLimitConnZones
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/limit_conns/{streamLimitConnZoneName}
  method: get
  operationId: getStreamLimitConnZone
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/limit_conns/{streamLimitConnZoneName}
  method: delete
  operationId: deleteStreamLimitConnZoneStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /stream/upstreams/
  method: get
  operationId: getStreamUpstreams
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/upstreams/{streamUpstreamName}/
  method: get
  operationId: getStreamUpstream
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/upstreams/{streamUpstreamName}/
  method: delete
  operationId: deleteStreamUpstreamStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /stream/upstreams/{streamUpstreamName}/servers/
  method: get
  operationId: getStreamUpstreamServers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/upstreams/{streamUpstreamName}/servers/
  method: post
  operationId: postStreamUpstreamServer
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /stream/upstreams/{streamUpstreamName}/servers/{streamUpstreamServerId}
  method: get
  operationId: getStreamUpstreamServer
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/upstreams/{streamUpstreamName}/servers/{streamUpstreamServerId}
  method: patch
  operationId: patchStreamUpstreamServer
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /stream/upstreams/{streamUpstreamName}/servers/{streamUpstreamServerId}
  method: delete
  operationId: deleteStreamUpstreamServer
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /stream/keyvals/
  method: get
  operationId: getStreamKeyvalZones
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/keyvals/{streamKeyvalZoneName}
  method: get
  operationId: getStreamKeyvalZoneKeysValues
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /stream/keyvals/{streamKeyvalZoneName}
  method: post
  operationId: postStreamKeyvalZoneData
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /stream/keyvals/{streamKeyvalZoneName}
  method: patch
  operationId: patchStreamKeyvalZoneKeyValue
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /stream/keyvals/{streamKeyvalZoneName}
  method: delete
  operationId: deleteStreamKeyvalZoneData
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /stream/zone_sync/
  method: get
  operationId: getStreamZoneSync
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /resolvers/
  method: get
  operationId: getResolverZones
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /resolvers/{resolverZoneName}
  method: get
  operationId: getResolverZone
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /resolvers/{resolverZoneName}
  method: delete
  operationId: deleteResolverZoneStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /ssl
  method: get
  operationId: getSsl
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /ssl
  method: delete
  operationId: deleteSslStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /license
  method: get
  operationId: getLicense
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /workers/
  method: get
  operationId: getWorkers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /workers/
  method: delete
  operationId: deleteWorkersStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /workers/{workerId}
  method: get
  operationId: getWorker
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /workers/{workerId}
  method: delete
  operationId: deleteWorkerStat
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /stub_status
  method: get
  operationId: getStubStatus
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none