ShootProof · Agentic Access

ShootProof Agentic Access

x-agentic-access generated

ShootProof exposes 67 API operations that an AI agent could call, of which 37 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.

By consequence: 30 read, 30 write, and 7 physical.

Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.

PhotographyClient GalleriesProofingDigital DownloadsPhoto Studio ManagementE-CommerceSaaS
Operations: 67 Acting: 37 Human-in-the-loop: 0 Method: generated

By consequence

read 30 write 30 physical 7

Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.

MethodPathConsequenceHuman-in-loop
POST /brand/{brandId}/contact/{contactId}/email physical conditional
POST /brand/{brandId}/contract/{contractId}/email physical conditional
POST /brand/{brandId}/order physical conditional
DELETE /brand/{brandId}/order/{orderId} physical conditional
POST /brand/{brandId}/order/{orderId}/email physical conditional
POST /brand/{brandId}/order/{orderId}/item physical conditional
POST /brand/{brandId}/order/{orderId}/lab-shipment physical conditional

Source

Agentic Access

Raw ↑ 
generated: '2026-07-15'
method: generated
source: openapi/shootproof-openapi.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 67
  by_action_class:
    connected: 30
    acting: 37
  by_consequence:
    read: 30
    write: 30
    physical: 7
  human_in_the_loop_required: 0
operations:
- path: /
  method: get
  operationId: getServiceDescription
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand
  method: get
  operationId: listBrands
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}
  method: get
  operationId: getBrand
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}
  method: patch
  operationId: updateBrandPartial
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/brand-theme
  method: get
  operationId: listBrandThemes
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/homepage
  method: get
  operationId: getBrandHomepage
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/homepage
  method: patch
  operationId: updateBrandHomepage
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/watermark
  method: get
  operationId: listBrandWatermarks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/sales-history
  method: get
  operationId: getBrandSalesHistory
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/gallery-activity-summary
  method: get
  operationId: getGalleryActivitySummary
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event
  method: get
  operationId: listEvents
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event
  method: post
  operationId: createEvent
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event
  method: patch
  operationId: updateEventsBatch
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event
  method: delete
  operationId: deleteEventsBatch
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}
  method: get
  operationId: getEvent
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}
  method: patch
  operationId: updateEventPartial
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}
  method: delete
  operationId: deleteEvent
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event-category
  method: get
  operationId: listEventCategories
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event-category
  method: post
  operationId: createEventCategory
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/album
  method: get
  operationId: listEventAlbums
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/album
  method: post
  operationId: createEventAlbum
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/album/{eventAlbumId}
  method: get
  operationId: getEventAlbum
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/album/{eventAlbumId}
  method: patch
  operationId: updateEventAlbumPartial
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/album/{eventAlbumId}
  method: delete
  operationId: deleteEventAlbum
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/digital-rule
  method: get
  operationId: listEventDigitalRules
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/digital-rule
  method: post
  operationId: createEventDigitalRule
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/qr-code
  method: get
  operationId: listEventQrCodes
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/qr-code
  method: post
  operationId: createEventQrCode
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/contact/{contactId}
  method: get
  operationId: getEventContact
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/contact/{contactId}
  method: put
  operationId: setEventContact
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/contact/{contactId}
  method: delete
  operationId: removeEventContact
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/photo
  method: get
  operationId: listEventPhotos
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/photo
  method: post
  operationId: createEventPhoto
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/photo
  method: patch
  operationId: updateEventPhotosBatch
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/photo
  method: delete
  operationId: deleteEventPhotosBatch
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/photo/upload-policy
  method: post
  operationId: createPhotoUploadPolicy
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/photo/{eventPhotoId}
  method: get
  operationId: getEventPhoto
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/photo/{eventPhotoId}
  method: patch
  operationId: updateEventPhotoPartial
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/photo/{eventPhotoId}
  method: delete
  operationId: removeEventPhoto
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/photo/{eventPhotoId}/original
  method: get
  operationId: getEventPhotoOriginal
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/album/{eventAlbumId}/zip-bundle
  method: post
  operationId: createAlbumZipBundle
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/event/{eventId}/zip-bundle
  method: post
  operationId: createEventZipBundle
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/contact
  method: get
  operationId: listContacts
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/contact
  method: post
  operationId: createContact
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/contact/tag
  method: get
  operationId: listContactTags
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/contact/{contactId}
  method: get
  operationId: getContact
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/contact/{contactId}
  method: put
  operationId: updateContact
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/contact/{contactId}
  method: delete
  operationId: deleteContact
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/contact/{contactId}/email
  method: post
  operationId: sendContactEmail
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/contact/{contactId}/recent-activity
  method: get
  operationId: getContactRecentActivity
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/order
  method: get
  operationId: listOrders
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/order
  method: post
  operationId: createOrder
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/order/{orderId}
  method: get
  operationId: getOrder
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/order/{orderId}
  method: delete
  operationId: deleteOrder
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/order/{orderId}/item
  method: get
  operationId: listOrderItems
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/order/{orderId}/item
  method: post
  operationId: createOrderItem
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/order/{orderId}/email
  method: post
  operationId: sendOrderEmail
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/order/{orderId}/lab-shipment
  method: post
  operationId: createLabShipment
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/order/{orderId}/payment
  method: get
  operationId: listOrderPayments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/contract
  method: get
  operationId: listContracts
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/contract
  method: post
  operationId: createContract
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/contract/template
  method: get
  operationId: listContractTemplates
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/contract/template
  method: post
  operationId: createContractTemplate
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/contract/{contractId}
  method: get
  operationId: getContract
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - studio
- path: /brand/{brandId}/contract/{contractId}
  method: patch
  operationId: updateContractPartial
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/contract/{contractId}
  method: delete
  operationId: deleteContract
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio
- path: /brand/{brandId}/contract/{contractId}/email
  method: post
  operationId: sendContractEmail
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - studio