Tvarka ATK API Agentic Access

generated: '2026-08-09'
method: generated
source: openapi/tvarka-atk-api-openapi-original.json
description: Recommended x-agentic-access execution contracts, classified heuristically from the OpenAPI.
  A governance starting point for exposing this API to AI agents — review and bind audience per deployment.
  See research/curity/agentic-governance/.
summary:
  operations: 22
  by_action_class:
    acting: 15
    connected: 7
  by_consequence:
    write: 15
    read: 7
  human_in_the_loop_required: 0
operations:
- path: /auth/requests
  method: post
  operationId: createAuthRequest
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /auth/{requestId}/certificate
  method: post
  operationId: submitAuthCertificate
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /auth/{requestId}/complete
  method: post
  operationId: completeAuth
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /auth/{requestId}
  method: get
  operationId: getAuthRequest
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /auth/{requestId}/cancel
  method: post
  operationId: cancelAuthRequest
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /auth/{requestId}/delete
  method: post
  operationId: deleteAuthRequest
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /erasure
  method: post
  operationId: bulkErasure
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /auth/{requestId}/pairing
  method: get
  operationId: getAuthPairing
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /pairing/claim
  method: post
  operationId: claimPairing
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /.well-known/atk-jwks.json
  method: get
  operationId: getJwks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sign/requests
  method: post
  operationId: createSignRequest
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sign/{requestId}/certificate
  method: post
  operationId: submitSignCertificate
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sign/{requestId}/complete
  method: post
  operationId: completeSign
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sign/{requestId}
  method: get
  operationId: getSignRequest
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sign/{requestId}/document
  method: get
  operationId: downloadSignedDocument
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /sign/{requestId}/cancel
  method: post
  operationId: cancelSignRequest
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sign/{requestId}/delete
  method: post
  operationId: deleteSignRequest
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /sign/{requestId}/pairing
  method: get
  operationId: getSignPairing
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /validation
  method: post
  operationId: validateDocument
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /timestamp
  method: post
  operationId: timestampDocument
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /archive
  method: post
  operationId: archiveDocument
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /services/{requestId}/document
  method: get
  operationId: downloadServiceDocument
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
note: 'Deduplicated to the canonical complete contract: the provider also publishes specialist auth.yaml
  and sign.yaml views that repeat the same operations, so the raw derivation counted 45.'
x-review:
- HEURISTIC OUTPUT - not a Tvarka claim. Review before binding.
- createSignRequest and completeSign produce a QUALIFIED ELECTRONIC SIGNATURE with legal effect under
  eIDAS; treat them as human-in-the-loop required, above the heuristic default.
- completeAuth produces a verified national eID identity; it should not run without a present card holder.
- deleteAuthRequest, deleteSignRequest and bulkErasure are irreversible GDPR erasures; treat as human-in-the-loop
  required.
- validateDocument, timestampDocument and archiveDocument carry a required Idempotency-Key, so an agent
  retry there is genuinely safe.