Riot · Agentic Access
Riot Agentic Access
x-agentic-access
generated
Riot exposes 40 API operations that an AI agent could call, of which 9 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.
By consequence: 31 read and 9 write.
Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.
cybersecuritysecurity-awarenesshuman-risk-managementphishing-simulationemployee-securitysecurity-posture-managementbreach-detectionemail-securitysaas-securityscimwebhooksocsffrance
Operations: 40
Acting: 9
Human-in-the-loop: 0
Method: generated
By consequence
read 31
write 9
Source
Agentic Access
generated: '2026-08-05'
method: generated
source: openapi/riot-public-api-openapi.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
audience per deployment. See research/curity/agentic-governance/.
summary:
operations: 40
by_action_class:
connected: 31
acting: 9
by_consequence:
read: 31
write: 9
human_in_the_loop_required: 0
operations:
- path: /scim/{workspace_id}/v2/Groups
method: get
operationId: groups_list_groups_ZC2NT5A
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- scim:read
token:
max-ttl: 3600
audit: none
- path: /scim/{workspace_id}/v2/Groups
method: post
operationId: groups_create_group_ZC2NT5A
x-agentic-access:
action-class: acting
consequence: write
subject: required
scope:
- scim:write
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /scim/{workspace_id}/v2/Groups/{group_id}
method: delete
operationId: groups_delete_group_ZC2NT5A
x-agentic-access:
action-class: acting
consequence: write
subject: required
scope:
- scim:write
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /scim/{workspace_id}/v2/Groups/{group_id}
method: get
operationId: groups_get_group_ZC2NT5A
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- scim:read
token:
max-ttl: 3600
audit: none
- path: /scim/{workspace_id}/v2/Groups/{group_id}
method: patch
operationId: groups_patch_group_ZC2NT5A
x-agentic-access:
action-class: acting
consequence: write
subject: required
scope:
- scim:write
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /scim/{workspace_id}/v2/Groups/{group_id}
method: put
operationId: groups_update_group_ZC2NT5A
x-agentic-access:
action-class: acting
consequence: write
subject: required
scope:
- scim:write
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /scim/{workspace_id}/v2/ResourceTypes
method: get
operationId: resource_types_list_resource_types_KKPMSEY
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- scim:read
token:
max-ttl: 3600
audit: none
- path: /scim/{workspace_id}/v2/ResourceTypes/{resource_type_id}
method: get
operationId: resource_types_get_resource_type_KKPMSEY
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- scim:read
token:
max-ttl: 3600
audit: none
- path: /scim/{workspace_id}/v2/Schemas
method: get
operationId: schemas_list_schemas_DEOEZDI
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- scim:read
token:
max-ttl: 3600
audit: none
- path: /scim/{workspace_id}/v2/Schemas/{schema}
method: get
operationId: schemas_get_schema_DEOEZDI
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- scim:read
token:
max-ttl: 3600
audit: none
- path: /scim/{workspace_id}/v2/ServiceProviderConfiguration
method: get
operationId: service_provider_configuration_get_service_provider_configuration_M4XZ6RY
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- scim:read
token:
max-ttl: 3600
audit: none
- path: /scim/{workspace_id}/v2/Users
method: get
operationId: users_list_users_3IQ5M4I
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- scim:read
token:
max-ttl: 3600
audit: none
- path: /scim/{workspace_id}/v2/Users
method: post
operationId: users_create_user_3IQ5M4I
x-agentic-access:
action-class: acting
consequence: write
subject: required
scope:
- scim:write
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /scim/{workspace_id}/v2/Users/{user_id}
method: delete
operationId: users_delete_user_3IQ5M4I
x-agentic-access:
action-class: acting
consequence: write
subject: required
scope:
- scim:write
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /scim/{workspace_id}/v2/Users/{user_id}
method: get
operationId: users_get_user_3IQ5M4I
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- scim:read
token:
max-ttl: 3600
audit: none
- path: /scim/{workspace_id}/v2/Users/{user_id}
method: patch
operationId: users_patch_user_3IQ5M4I
x-agentic-access:
action-class: acting
consequence: write
subject: required
scope:
- scim:write
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /scim/{workspace_id}/v2/Users/{user_id}
method: put
operationId: users_update_user_3IQ5M4I
x-agentic-access:
action-class: acting
consequence: write
subject: required
scope:
- scim:write
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /v1/attack_login_domains
method: get
operationId: attack_login_domains_get_attack_login_domain_paginated_XU5W4YI
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- simulation:read
token:
max-ttl: 3600
audit: none
- path: /v1/breaches
method: get
operationId: breaches_get_paginated_FAUE35Y
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- breaches:read
token:
max-ttl: 3600
audit: none
- path: /v1/breaches/statistics
method: get
operationId: breaches_get_statistics_FAUE35Y
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- breaches:read
token:
max-ttl: 3600
audit: none
- path: /v1/breaches/{breach_id}/compromised-employees
method: get
operationId: breaches_get_breach_compromised_employees_FAUE35Y
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- breaches:read
token:
max-ttl: 3600
audit: none
- path: /v1/campaigns
method: get
operationId: campaigns_get_paginated_CWCTX3I
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- simulation:read
token:
max-ttl: 3600
audit: none
- path: /v1/campaigns/statistics
method: get
operationId: campaigns_get_statistics_CWCTX3I
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- simulation:read
token:
max-ttl: 3600
audit: none
- path: /v1/campaigns/{campaign_id}/attacks
method: get
operationId: attacks_get_paginated_KCLEOEQ
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- simulation:read
token:
max-ttl: 3600
audit: none
- path: /v1/courses
method: get
operationId: courses_get_paginated_DJESCNQ
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- awareness:read
token:
max-ttl: 3600
audit: none
- path: /v1/courses/employees_progress
method: get
operationId: courses_get_employees_progress_DJESCNQ
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- awareness:read
token:
max-ttl: 3600
audit: none
- path: /v1/courses/statistics
method: get
operationId: courses_get_statistics_DJESCNQ
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- awareness:read
token:
max-ttl: 3600
audit: none
- path: /v1/courses/{course_id}
method: get
operationId: courses_get_course_statuses_of_employees_DJESCNQ
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- awareness:read
token:
max-ttl: 3600
audit: none
- path: /v1/domains
method: get
operationId: domains_get_paginated_domains_OOWLIAA
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- workspace:read
token:
max-ttl: 3600
audit: none
- path: /v1/email_reports/report_attack_from_message_id
method: post
operationId: reports_report_attack_from_message_id_DO4XYPA
x-agentic-access:
action-class: acting
consequence: write
subject: required
scope:
- inbox:write
audience: null
token:
max-ttl: 900
escalation:
human-in-the-loop: conditional
triggers:
- abnormal
- high-value
audit: required
- path: /v1/employees
method: get
operationId: employees_get_paginated_LRY7OLI
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- workspace:read
token:
max-ttl: 3600
audit: none
- path: /v1/employees/statistics
method: get
operationId: employees_get_statistics_LRY7OLI
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- workspace:read
token:
max-ttl: 3600
audit: none
- path: /v1/employees/{employee_id}
method: get
operationId: employees_get_LRY7OLI
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- workspace:read
token:
max-ttl: 3600
audit: none
- path: /v1/groups
method: get
operationId: groups_get_paginated_BOILCUA
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- groups:read
token:
max-ttl: 3600
audit: none
- path: /v1/groups/{group_id}/employees
method: get
operationId: groups_get_group_employees_BOILCUA
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- groups:read
token:
max-ttl: 3600
audit: none
- path: /v1/inbox_tickets/list_employees_with_email_reports
method: get
operationId: inbox_tickets_list_employees_with_email_reports_QHKH7RI
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- inbox:read
token:
max-ttl: 3600
audit: none
- path: /v1/inbox_tickets/statistics
method: get
operationId: inbox_tickets_get_inbox_statistics_QHKH7RI
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- inbox:read
token:
max-ttl: 3600
audit: none
- path: /v1/organization
method: get
operationId: organizations_get_XEBQFJQ
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- workspace:read
token:
max-ttl: 3600
audit: none
- path: /v1/slash/employees/alert_statistics
method: get
operationId: inbound_protections_list_employees_with_alerts_stats_YGL572Y
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- inbox:read
token:
max-ttl: 3600
audit: none
- path: /v1/slash/employees/impersonation_statistics
method: get
operationId: inbound_protections_list_employees_with_impersonation_stats_YGL572Y
x-agentic-access:
action-class: connected
consequence: read
subject: optional
scope:
- inbox:read
token:
max-ttl: 3600
audit: none