WorkOS · Agentic Access

WorkOS Agentic Access

x-agentic-access generated

WorkOS exposes 172 API operations that an AI agent could call, of which 98 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.

By consequence: 74 read and 98 safety-critical.

98 operations are classed safety-critical and should require human-in-the-loop approval at runtime.

Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.

AuthenticationIdentity ProviderSSOSAMLOIDCSCIMDirectory SyncAuthorizationFGAAudit LogsMFAB2B SaaSAgentsMCP
Operations: 172 Acting: 98 Human-in-the-loop: 98 Method: generated

By consequence

read 74 safety-critical 98

Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.

MethodPathConsequenceHuman-in-loop
POST /api_keys/validations safety-critical required
DELETE /api_keys/{id} safety-critical required
POST /audit_logs/actions/{actionName}/schemas safety-critical required
POST /audit_logs/events safety-critical required
POST /audit_logs/exports safety-critical required
POST /auth/challenges/{id}/verify safety-critical required
POST /auth/factors/enroll safety-critical required
DELETE /auth/factors/{id} safety-critical required
POST /auth/factors/{id}/challenge safety-critical required
POST /authkit/oauth2/complete safety-critical required
POST /authorization/organization_memberships/{organization_membership_id}/check safety-critical required
POST /authorization/organization_memberships/{organization_membership_id}/role_assignments safety-critical required
DELETE /authorization/organization_memberships/{organization_membership_id}/role_assignments safety-critical required
DELETE /authorization/organization_memberships/{organization_membership_id}/role_assignments/{role_assignment_id} safety-critical required
POST /authorization/organizations/{organizationId}/roles safety-critical required
PATCH /authorization/organizations/{organizationId}/roles/{slug} safety-critical required
DELETE /authorization/organizations/{organizationId}/roles/{slug} safety-critical required
PUT /authorization/organizations/{organizationId}/roles/{slug}/permissions safety-critical required
POST /authorization/organizations/{organizationId}/roles/{slug}/permissions safety-critical required
DELETE /authorization/organizations/{organizationId}/roles/{slug}/permissions/{permissionSlug} safety-critical required
PATCH /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id} safety-critical required
DELETE /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id} safety-critical required
POST /authorization/permissions safety-critical required
PATCH /authorization/permissions/{slug} safety-critical required
DELETE /authorization/permissions/{slug} safety-critical required

Source

Agentic Access

Raw ↑ 
generated: '2026-07-15'
method: generated
source: openapi/workos-openapi.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 172
  by_action_class:
    acting: 98
    connected: 74
  by_consequence:
    safety-critical: 98
    read: 74
  human_in_the_loop_required: 98
operations:
- path: /api_keys/validations
  method: post
  operationId: ApiKeysController_validateApiKey
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /api_keys/{id}
  method: delete
  operationId: ApiKeysController_delete
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /audit_logs/actions
  method: get
  operationId: AuditLogValidatorsController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /audit_logs/actions/{actionName}/schemas
  method: post
  operationId: AuditLogValidatorVersionsController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /audit_logs/actions/{actionName}/schemas
  method: get
  operationId: AuditLogValidatorVersionsController_schemas
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /audit_logs/events
  method: post
  operationId: AuditLogEventsController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /audit_logs/exports
  method: post
  operationId: AuditLogExportsController_exports
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /audit_logs/exports/{auditLogExportId}
  method: get
  operationId: AuditLogExportsController_export
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /auth/challenges/{id}/verify
  method: post
  operationId: AuthenticationChallengesController_verify
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /auth/factors/enroll
  method: post
  operationId: AuthenticationFactorsController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /auth/factors/{id}
  method: get
  operationId: AuthenticationFactorsController_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /auth/factors/{id}
  method: delete
  operationId: AuthenticationFactorsController_delete
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /auth/factors/{id}/challenge
  method: post
  operationId: AuthenticationFactorsController_challenge
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authkit/oauth2/complete
  method: post
  operationId: ExternalAuthController_completeLogin
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organization_memberships/{organization_membership_id}/check
  method: post
  operationId: AuthorizationController_check
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organization_memberships/{organization_membership_id}/resources
  method: get
  operationId: AuthorizationController_listResourcesForMembership
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/organization_memberships/{organization_membership_id}/resources/{resource_id}/permissions
  method: get
  operationId: AuthorizationController_listEffectivePermissions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/organization_memberships/{organization_membership_id}/resources/{resource_type_slug}/{external_id}/permissions
  method: get
  operationId: AuthorizationController_listEffectivePermissionsByExternalId
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/organization_memberships/{organization_membership_id}/role_assignments
  method: get
  operationId: AuthorizationRoleAssignmentsController_listRoleAssignments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/organization_memberships/{organization_membership_id}/role_assignments
  method: post
  operationId: AuthorizationRoleAssignmentsController_assignRole
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organization_memberships/{organization_membership_id}/role_assignments
  method: delete
  operationId: AuthorizationRoleAssignmentsController_removeRoleByCriteria
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organization_memberships/{organization_membership_id}/role_assignments/{role_assignment_id}
  method: delete
  operationId: AuthorizationRoleAssignmentsController_removeRoleById
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organizations/{organizationId}/roles
  method: post
  operationId: AuthorizationOrganizationRolesController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organizations/{organizationId}/roles
  method: get
  operationId: AuthorizationOrganizationRolesController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/organizations/{organizationId}/roles/{slug}
  method: get
  operationId: AuthorizationOrganizationRolesController_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/organizations/{organizationId}/roles/{slug}
  method: patch
  operationId: AuthorizationOrganizationRolesController_update
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organizations/{organizationId}/roles/{slug}
  method: delete
  operationId: AuthorizationOrganizationRolesController_delete
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organizations/{organizationId}/roles/{slug}/permissions
  method: put
  operationId: AuthorizationOrganizationRolePermissionsController_setPermissions
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organizations/{organizationId}/roles/{slug}/permissions
  method: post
  operationId: AuthorizationOrganizationRolePermissionsController_addPermission
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organizations/{organizationId}/roles/{slug}/permissions/{permissionSlug}
  method: delete
  operationId: AuthorizationOrganizationRolePermissionsController_removePermission
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}
  method: get
  operationId: AuthorizationResourcesByExternalIdController_getByExternalId
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}
  method: patch
  operationId: AuthorizationResourcesByExternalIdController_updateByExternalId
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}
  method: delete
  operationId: AuthorizationResourcesByExternalIdController_deleteByExternalId
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}/organization_memberships
  method: get
  operationId: AuthorizationResourcesByExternalIdController_listOrganizationMembershipsForResourceByExternalId
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}/role_assignments
  method: get
  operationId: AuthorizationRoleAssignmentsController_listRoleAssignmentsForResourceByExternalId
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/permissions
  method: get
  operationId: AuthorizationPermissionsController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/permissions
  method: post
  operationId: AuthorizationPermissionsController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/permissions/{slug}
  method: get
  operationId: AuthorizationPermissionsController_find
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/permissions/{slug}
  method: patch
  operationId: AuthorizationPermissionsController_update
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/permissions/{slug}
  method: delete
  operationId: AuthorizationPermissionsController_delete
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/resources
  method: get
  operationId: AuthorizationResourcesController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/resources
  method: post
  operationId: AuthorizationResourcesController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/resources/{resource_id}
  method: get
  operationId: AuthorizationResourcesController_findById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/resources/{resource_id}
  method: patch
  operationId: AuthorizationResourcesController_update
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/resources/{resource_id}
  method: delete
  operationId: AuthorizationResourcesController_delete
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/resources/{resource_id}/organization_memberships
  method: get
  operationId: AuthorizationResourcesController_listOrganizationMembershipsForResource
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/resources/{resource_id}/role_assignments
  method: get
  operationId: AuthorizationRoleAssignmentsController_listRoleAssignmentsForResource
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/roles
  method: post
  operationId: AuthorizationRolesController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/roles
  method: get
  operationId: AuthorizationRolesController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/roles/{slug}
  method: get
  operationId: AuthorizationRolesController_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /authorization/roles/{slug}
  method: patch
  operationId: AuthorizationRolesController_update
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/roles/{slug}/permissions
  method: put
  operationId: AuthorizationRolePermissionsController_setPermissions
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /authorization/roles/{slug}/permissions
  method: post
  operationId: AuthorizationRolePermissionsController_addPermission
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /connect/applications
  method: get
  operationId: ApplicationsController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /connect/applications
  method: post
  operationId: ApplicationsController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /connect/applications/{id}
  method: get
  operationId: ApplicationsController_find
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /connect/applications/{id}
  method: put
  operationId: ApplicationsController_update
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /connect/applications/{id}
  method: delete
  operationId: ApplicationsController_delete
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /connect/applications/{id}/client_secrets
  method: get
  operationId: ApplicationCredentialsController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /connect/applications/{id}/client_secrets
  method: post
  operationId: ApplicationCredentialsController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /connect/client_secrets/{id}
  method: delete
  operationId: ApplicationCredentialsController_delete
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /connections
  method: get
  operationId: ConnectionsController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /connections/{id}
  method: get
  operationId: ConnectionsController_find
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /connections/{id}
  method: delete
  operationId: ConnectionsController_delete
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /data-integrations/{slug}/authorize
  method: post
  operationId: DataIntegrationsController_getDataIntegrationAuthorizeUrl
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /data-integrations/{slug}/token
  method: post
  operationId: DataIntegrationsController_getUserlandUserToken
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /directories
  method: get
  operationId: DirectoriesController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /directories/{id}
  method: get
  operationId: DirectoriesController_find
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /directories/{id}
  method: delete
  operationId: DirectoriesController_deleteDirectory
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /directory_groups
  method: get
  operationId: DirectoryGroupsController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /directory_groups/{id}
  method: get
  operationId: DirectoryGroupsController_find
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /directory_users
  method: get
  operationId: DirectoryUsersController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /directory_users/{id}
  method: get
  operationId: DirectoryUsersController_find
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /events
  method: get
  operationId: EventsController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /feature-flags
  method: get
  operationId: FeatureFlagsController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /feature-flags/{slug}
  method: get
  operationId: FeatureFlagsController_findBySlug
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /feature-flags/{slug}/disable
  method: put
  operationId: FeatureFlagsController_disableFlag
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /feature-flags/{slug}/enable
  method: put
  operationId: FeatureFlagsController_enableFlag
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /feature-flags/{slug}/targets/{resourceId}
  method: post
  operationId: FlagTargetsController_createTarget
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /feature-flags/{slug}/targets/{resourceId}
  method: delete
  operationId: FlagTargetsController_deleteTarget
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /organization_domains
  method: post
  operationId: OrganizationDomainsController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /organization_domains/{id}
  method: get
  operationId: OrganizationDomainsController_get
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /organization_domains/{id}
  method: delete
  operationId: OrganizationDomainsController_delete
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /organization_domains/{id}/verify
  method: post
  operationId: OrganizationDomainsController_verify
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /organizations
  method: get
  operationId: OrganizationsController_list
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /organizations
  method: post
  operationId: OrganizationsController_create
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /organizations/external_id/{external_id}
  method: get
  operationId: OrganizationsController_getByExternalId
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /organizations/{id}
  method: get
  operationId: OrganizationsController_find
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /organizations/{id}
  method: put
  operationId: OrganizationsController_updateOrganization
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /organizations/{id}
  method: delete
  operationId: OrganizationsController_deleteOrganization
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /organizations/{id}/audit_log_configuration
  method: get
  operationId: OrganizationsController_getAuditLogConfiguration
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /organizations/{id}/audit_logs_retention
  method: get
  operationId: AuditLogsRetentionController_auditLogsRetention
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
- path: /organizations/{id}/audit_logs_retention
  method: put
  operationId: AuditLogsRetentionControlle

# --- truncated at 32 KB (59 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/workos/refs/heads/main/agentic-access/workos-agentic-access.yml