Workday · Agentic Access
Workday Agentic Access

x-agentic-access generated
Workday exposes 104 API operations that an AI agent could call, of which 17 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.
By consequence: 87 read, 14 write, 2 physical, and 1 safety-critical.
1 operation are classed safety-critical and should require human-in-the-loop approval at runtime.
Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.
Cloud ComputingEnterprise SoftwareFinancial ManagementHCMSaaS
Operations: 104 Acting: 17 Human-in-the-loop: 1 Method: generated
By consequence

read 87 write 14 physical 2 safety-critical 1
Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.
Method	Path	Consequence	Human-in-loop
POST	/workers/{ID}/terminate	safety-critical	required
POST	/workers/{ID}/requestOneTimePayment	physical	conditional
POST	/workers/{ID}/requestOneTimePayment	physical	conditional
Source

Agentic Access

generated: '2026-07-15'
method: generated
source: openapi/absenceManagement.yml, openapi/benefits.yml, openapi/common.yml, openapi/compensation.yml,
  openapi/financialManagement.yml, openapi/hcm.yml, openapi/payroll.yml, openapi/performanceManagement.yml,
  openapi/person.yml, openapi/prismAnalytics.yml, openapi/raas.yml, openapi/recruiting.yml,
  openapi/staffing.yml, openapi/talent.yml, openapi/timeTracking.yml, openapi/wql.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 104
  by_action_class:
    connected: 87
    acting: 17
  by_consequence:
    read: 87
    write: 14
    physical: 2
    safety-critical: 1
  human_in_the_loop_required: 1
operations:
- path: /workers/{ID}/eligibleAbsenceTypes
  method: get
  operationId: getEligibleAbsenceTypes
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_absence
    - w_absence
- path: /workers/{ID}/requestTimeOff
  method: post
  operationId: requestTimeOff
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_absence
    - w_absence
- path: /workers/{ID}/timeOffEntries
  method: get
  operationId: getTimeOffEntries
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_absence
    - w_absence
- path: /workers/{ID}/timeOffBalances
  method: get
  operationId: getTimeOffBalances
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_absence
    - w_absence
- path: /workers/{ID}/leaveOfAbsences
  method: get
  operationId: getLeavesOfAbsence
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_absence
    - w_absence
- path: /workers/{ID}/requestLeaveOfAbsence
  method: post
  operationId: requestLeaveOfAbsence
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_absence
    - w_absence
- path: /workers/{ID}/benefitElections
  method: get
  operationId: getBenefitElections
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_benefits
    - w_benefits
- path: /workers/{ID}/eligibleBenefitPlans
  method: get
  operationId: getEligibleBenefitPlans
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_benefits
    - w_benefits
- path: /workers/{ID}/dependents
  method: get
  operationId: getDependents
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_benefits
    - w_benefits
- path: /workers/{ID}/changeBenefits
  method: post
  operationId: changeBenefits
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_benefits
    - w_benefits
- path: /benefitPlans
  method: get
  operationId: getBenefitPlans
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_benefits
    - w_benefits
- path: /countries
  method: get
  operationId: getCountries
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_common
- path: /countries/{ID}
  method: get
  operationId: getCountryById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_common
- path: /currencies
  method: get
  operationId: getCurrencies
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_common
- path: /currencies/{ID}
  method: get
  operationId: getCurrencyById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_common
- path: /languages
  method: get
  operationId: getLanguages
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_common
- path: /genders
  method: get
  operationId: getGenders
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_common
- path: /maritalStatuses
  method: get
  operationId: getMaritalStatuses
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_common
- path: /workers/{ID}/compensationPlans
  method: get
  operationId: getCompensationPlans
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_compensation
    - w_compensation
- path: /workers/{ID}/requestCompensationChange
  method: post
  operationId: requestCompensationChange
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_compensation
    - w_compensation
- path: /compensationScorecards
  method: get
  operationId: getCompensationScorecards
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_compensation
    - w_compensation
- path: /compensationScorecards/{ID}
  method: get
  operationId: getCompensationScorecardById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_compensation
    - w_compensation
- path: /compensationScorecards/{ID}/results
  method: get
  operationId: getCompensationScorecardResults
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_compensation
    - w_compensation
- path: /workers/{ID}/requestOneTimePayment
  method: post
  operationId: requestOneTimePayment
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_compensation
    - w_compensation
- path: /compensationGrades
  method: get
  operationId: getCompensationGrades
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_compensation
    - w_compensation
- path: /accountingJournals
  method: get
  operationId: getAccountingJournals
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_financials
    - w_financials
- path: /accountingJournals/{ID}
  method: get
  operationId: getAccountingJournalById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_financials
    - w_financials
- path: /suppliers
  method: get
  operationId: getSuppliers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_financials
    - w_financials
- path: /suppliers/{ID}
  method: get
  operationId: getSupplierById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_financials
    - w_financials
- path: /purchaseOrders
  method: get
  operationId: getPurchaseOrders
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_financials
    - w_financials
- path: /expenseReports
  method: get
  operationId: getExpenseReports
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_financials
    - w_financials
- path: /expenseReports/{ID}
  method: get
  operationId: getExpenseReportById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_financials
    - w_financials
- path: /customerInvoices
  method: get
  operationId: getCustomerInvoices
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_financials
    - w_financials
- path: /workers
  method: get
  operationId: getWorkers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_worker
    - w_worker
- path: /workers/{ID}
  method: get
  operationId: getWorkerById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_worker
    - w_worker
- path: /workers/{ID}/history
  method: get
  operationId: getWorkerHistory
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_worker
    - w_worker
- path: /workers/{ID}/photos
  method: get
  operationId: getWorkerPhoto
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_worker
    - w_worker
- path: /workers/{ID}/businessTitleChanges
  method: get
  operationId: getWorkerBusinessTitleChanges
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_worker
    - w_worker
- path: /workers/{ID}/inboxTasks
  method: get
  operationId: getWorkerInboxTasks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_worker
    - w_worker
- path: /supervisoryOrganizations
  method: get
  operationId: getSupervisoryOrganizations
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_worker
    - w_worker
- path: /supervisoryOrganizations/{ID}
  method: get
  operationId: getSupervisoryOrganizationById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_worker
    - w_worker
- path: /locations
  method: get
  operationId: getLocations
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_worker
    - w_worker
- path: /locations/{ID}
  method: get
  operationId: getLocationById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_worker
    - w_worker
- path: /payGroups
  method: get
  operationId: getPayGroups
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_payroll
    - w_payroll
- path: /payGroups/{ID}
  method: get
  operationId: getPayGroupById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_payroll
    - w_payroll
- path: /payGroups/{ID}/payGroupDetails
  method: get
  operationId: getPayGroupDetails
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_payroll
    - w_payroll
- path: /workers/{ID}/payrollInputs
  method: get
  operationId: getPayrollInputs
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_payroll
    - w_payroll
- path: /workers/{ID}/paySlips
  method: get
  operationId: getPaySlips
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_payroll
    - w_payroll
- path: /workers/{ID}/goals
  method: get
  operationId: getWorkerGoals
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_performance
    - w_performance
- path: /workers/{ID}/performanceReviews
  method: get
  operationId: getPerformanceReviews
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_performance
    - w_performance
- path: /workers/{ID}/feedbackBadges
  method: get
  operationId: getFeedbackBadges
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_performance
    - w_performance
- path: /workers/{ID}/feedbackBadges
  method: post
  operationId: giveFeedbackBadge
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_performance
    - w_performance
- path: /workers/{ID}/requestFeedback
  method: post
  operationId: requestFeedback
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_performance
    - w_performance
- path: /people
  method: get
  operationId: getPeople
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_person
    - w_person
- path: /people/{ID}
  method: get
  operationId: getPersonById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_person
    - w_person
- path: /people/{ID}/homeContactInformation
  method: get
  operationId: getHomeContactInformation
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_person
    - w_person
- path: /people/{ID}/workContactInformation
  method: get
  operationId: getWorkContactInformation
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_person
    - w_person
- path: /people/{ID}/personalInformation
  method: get
  operationId: getPersonalInformation
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_person
    - w_person
- path: /datasets
  method: get
  operationId: getDatasets
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_prism
    - w_prism
- path: /datasets
  method: post
  operationId: createDataset
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_prism
    - w_prism
- path: /datasets/{ID}
  method: get
  operationId: getDatasetById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_prism
    - w_prism
- path: /datasets/{ID}
  method: put
  operationId: updateDataset
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_prism
    - w_prism
- path: /datasets/{ID}
  method: delete
  operationId: deleteDataset
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_prism
    - w_prism
- path: /dataChangeTasks
  method: get
  operationId: getDataChangeTasks
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_prism
    - w_prism
- path: /dataChangeTasks
  method: post
  operationId: createDataChangeTask
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_prism
    - w_prism
- path: /dataChangeTasks/{ID}
  method: get
  operationId: getDataChangeTaskById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_prism
    - w_prism
- path: /dataChangeTasks/{ID}/activities
  method: get
  operationId: getDataChangeTaskActivities
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_prism
    - w_prism
- path: /fileContainers
  method: post
  operationId: createFileContainer
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_prism
    - w_prism
- path: /fileContainers/{ID}
  method: get
  operationId: getFileContainerById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_prism
    - w_prism
- path: /tables
  method: get
  operationId: getTables
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_prism
    - w_prism
- path: /tables/{ID}
  method: get
  operationId: getTableById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_prism
    - w_prism
- path: /{reportOwner}/{reportName}
  method: get
  operationId: getCustomReport
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_reports
- path: /jobRequisitions
  method: get
  operationId: getJobRequisitions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_recruiting
    - w_recruiting
- path: /jobRequisitions/{ID}
  method: get
  operationId: getJobRequisitionById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_recruiting
    - w_recruiting
- path: /jobPostings
  method: get
  operationId: getJobPostings
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_recruiting
    - w_recruiting
- path: /jobPostings/{ID}
  method: get
  operationId: getJobPostingById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_recruiting
    - w_recruiting
- path: /candidates
  method: get
  operationId: getCandidates
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_recruiting
    - w_recruiting
- path: /candidates/{ID}
  method: get
  operationId: getCandidateById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_recruiting
    - w_recruiting
- path: /jobApplications
  method: get
  operationId: getJobApplications
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_recruiting
    - w_recruiting
- path: /jobApplications/{ID}
  method: get
  operationId: getJobApplicationById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_recruiting
    - w_recruiting
- path: /prospects
  method: get
  operationId: getProspects
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_recruiting
    - w_recruiting
- path: /workers/{ID}/organizationAssignments
  method: get
  operationId: getOrganizationAssignments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_staffing
    - w_staffing
- path: /workers/{ID}/jobChanges
  method: post
  operationId: createJobChange
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_staffing
    - w_staffing
- path: /jobProfiles
  method: get
  operationId: getJobProfiles
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_staffing
    - w_staffing
- path: /jobProfiles/{ID}
  method: get
  operationId: getJobProfileById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_staffing
    - w_staffing
- path: /positions
  method: get
  operationId: getPositions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_staffing
    - w_staffing
- path: /positions/{ID}
  method: get
  operationId: getPositionById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_staffing
    - w_staffing
- path: /workers/{ID}/requestOneTimePayment
  method: post
  operationId: requestOneTimePayment
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_staffing
    - w_staffing
- path: /workers/{ID}/terminate
  method: post
  operationId: terminateWorker
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
    scope:
    - r_staffing
    - w_staffing
- path: /workers/{ID}/talentProfile
  method: get
  operationId: getTalentProfile
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_talent
    - w_talent
- path: /workers/{ID}/mentorships
  method: get
  operationId: getMentorships
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_talent
    - w_talent
- path: /workers/{ID}/skills
  method: get
  operationId: getWorkerSkills
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_talent
    - w_talent
- path: /workers/{ID}/certifications
  method: get
  operationId: getWorkerCertifications
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_talent
    - w_talent
- path: /successionPlans
  method: get
  operationId: getSuccessionPlans
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_talent
    - w_talent
- path: /successionPlans/{ID}
  method: get
  operationId: getSuccessionPlanById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_talent
    - w_talent
- path: /workers/{ID}/timeClockEvents
  method: get
  operationId: getTimeClockEvents
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_timeTracking
    - w_timeTracking
- path: /workers/{ID}/timeClockEvents
  method: post
  operationId: createTimeClockEvent
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_timeTracking
    - w_timeTracking
- path: /workers/{ID}/timeEntries
  method: get
  operationId: getTimeEntries
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_timeTracking
    - w_timeTracking
- path: /workers/{ID}/timesheets
  method: get
  operationId: getTimesheets
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_timeTracking
    - w_timeTracking
- path: /workers/{ID}/requestTimeEntry
  method: post
  operationId: requestTimeEntry
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - r_timeTracking
    - w_timeTracking
- path: /data
  method: get
  operationId: executeWqlQuery
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_wql
- path: /dataSources
  method: get
  operationId: getDataSources
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_wql
- path: /dataSources/{ID}
  method: get
  operationId: getDataSourceById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_wql
- path: /dataSources/{ID}/fields
  method: get
  operationId: getDataSourceFields
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - r_wql