{ "schema": "claude-cowork-capability-v1", "connector": { "id": "agined", "name": "Agined + Attestor", "publisher": "Agined", "description": "Manage Agined compliance audit + Attestor cryptographic receipts from Claude — fully scoped to your active workspace.", "homepage": "https://agined.com", "privacy_url": "https://agined.com/privacy", "terms_url": "https://agined.com/legal", "icon_url": "https://cdn.agined.com/static/files/media/images/v1/agined-mark-512.png", "version": "0.32.289-agined.1" }, "transport": { "mcp": { "endpoint": "https://mcp.a2pi.app/mcp" }, "oauth2": { "authorization_endpoint": "https://agined.com/auth/authorize", "token_endpoint": "https://api.agined.com/api/v1/oauth/token", "scopes": [ "organization.rename", "billing.view", "members.view", "members.invite", "members.remove", "members.change_role", "organization.transfer_ownership", "organization.delete", "settings.view_audit_log", "settings.configure_sso", "workspaces.view", "workspaces.create", "settings.view", "workspace.rename", "workspaces.delete", "workspace.schedule_deletion", "workspaces.transfer", "billing.change_plan", "billing.buy_pack", "billing.configure_autotopup", "billing.subscribe_addons", "keys.view", "keys.create", "keys.revoke", "webhooks.view", "webhooks.create", "webhooks.delete", "exports.view", "exports.create", "exports.download", "settings.edit_retention", "settings.edit_integrations", "settings.edit_capabilities", "attestor.attest.agent-call", "attestor.attest.content", "attestor.attest.llm", "attestor.attest.commit", "attestor.deliver.webhook", "attestor.monitors.create", "attestor.monitors.view", "attestor.monitors.delete", "attestor.dns.create", "attestor.dns.view", "attestor.dns.delete", "attestor.tls.create", "attestor.tls.view", "attestor.tls.delete", "attestor.receipts.view", "attestor.usage.view", "attestor.subscription.view", "attestor.abuse.view", "attestor.abuse.appeal", "agents.create", "agents.view", "agents.delete", "records.view", "integrations.view", "integrations.connect", "integrations.disconnect" ], "pkce_required": true, "dpop_required": true } }, "surface_hints": { "suggested_prompts": [ { "label": "Show me my audit log for the last hour", "prompt": "Read my workspace audit log for the last hour and summarize anything unusual." }, { "label": "Verify an Attestor receipt", "prompt": "Verify the Attestor receipt with id ${receiptId} and explain whether the chain is intact." }, { "label": "Request my EU AI Act Article 12 export", "prompt": "Request an EU AI Act Article 12 export for workspace ${workspaceId} for the last 90 days." }, { "label": "Tighten my Tops sampling for production", "prompt": "Update my workspace Tops config so production runs are sampled at 100% with detail level extended." }, { "label": "Top up my Attestor budget", "prompt": "Add a $100 Attestor run pack to my workspace ${workspaceId} (confirm before charging)." } ], "primary_actions": [ { "tool": "account.session.list", "label": "List active sessions on this account." }, { "tool": "account.profile.get", "label": "Get the authenticated account's profile." }, { "tool": "account.email.change.pending", "label": "The email change currently in flight for this account, if any, and which address still has to confirm it." }, { "tool": "account.passkey.list", "label": "List registered passkeys." }, { "tool": "account.notifications.get", "label": "Read notification preferences." }, { "tool": "account.token.list", "label": "List your Personal Access Tokens (PATs)." }, { "tool": "account.oauth-grants.list", "label": "List active OAuth grants to third-party agents (Claude, ChatGPT, Gemini, etc.)." }, { "tool": "account.security-log.list", "label": "Read the account-level security log (logins, MFA, key issuance, anomalies)." } ], "confirmation_required_actions": [ "account.session.revoke", "account.email.change", "account.passkey.revoke", "account.token.revoke", "account.oauth-grants.revoke", "account.delete", "org.member.remove", "org.transfer-ownership", "org.delete.schedule", "org.sso.connections.upsert", "org.sso.connections.delete", "org.sso.domains.enforcement", "org.sso.domains.delete", "org.sso.scim-tokens.mint", "org.sso.scim-tokens.revoke", "workspace.create", "workspace.delete.schedule", "workspace.member.remove", "workspace.transfer-ownership", "workspace.attestor.enable", "workspace.attestor.disable", "billing.subscription.upgrade", "billing.subscription.downgrade", "billing.subscription.cancel", "billing.subscription.reactivate", "billing.packs.purchase", "billing.auto-topup.configure", "billing.cost-centers.delete", "billing.notarian.subscribe", "billing.notarian.unsubscribe", "billing.retention-extension.unsubscribe", "billing.multi-workspace.subscribe", "billing.multi-workspace.unsubscribe", "billing.infinite-memory.subscribe", "billing.infinite-memory.unsubscribe", "billing.retention-extension.subscribe", "billing.attestor.tier.set", "billing.attestor.top-up.purchase", "billing.attestor.auto-overage.set", "billing.ledger-bundles.subscribe", "billing.ledger-bundles.unsubscribe", "keys.issue", "keys.revoke", "keys.rotate", "keys.attestor.issue", "keys.ingest-secret.issue", "keys.ingest-secret.revoke", "webhooks.delete", "webhooks.signing-secret.rotate", "alerts.delete", "exports.delete", "retention.policy.update", "retention.extension.subscribe", "retention.extension.update", "retention.extension.cancel", "audit.stream.configure", "audit.stream.delete", "tops.config.delete", "tops.specimen.set", "tops.specimen.delete", "number_one.conversation.delete", "number_one.memory.erase", "number_one.llm-billing.set", "attestor.monitor.http.remove", "attestor.watch.dns.remove", "attestor.watch.tls.remove", "attestor.subscription.cancel", "attestor.signing-key.rotate-request", "ledger-bundles.snapshot.create", "privacy.dsr.submit", "privacy.export.request", "agents.identity.rotate", "agents.identity.revoke", "agents.identity.delegate.revoke", "agents.mandate.revoke", "fabric.retrieve.signed", "fabric.memory.snapshot", "fabric.connections.revoke", "fabric.webhooks.revoke", "lens.execute", "lens.custom.delete", "lens.marketplace.unpublish", "lens.marketplace.uninstall", "notarian.snapshot.create" ] }, "tools": [ { "id": "account.session.list", "domain": "account", "summary": "List active sessions on this account.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "account.session.revoke", "domain": "account", "summary": "Revoke an active session by id (cannot be disabled — safety floor).", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "account.profile.get", "domain": "account", "summary": "Get the authenticated account's profile.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "account.profile.update", "domain": "account", "summary": "Update account profile (display name, avatar URL).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "account.email.change", "domain": "account", "summary": "Request an email change. A verification email is sent to the new address; the change applies only after click-through.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "account.email.change.pending", "domain": "account", "summary": "The email change currently in flight for this account, if any, and which address still has to confirm it.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "account.passkey.list", "domain": "account", "summary": "List registered passkeys.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "account.passkey.revoke", "domain": "account", "summary": "Revoke a registered passkey.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "account.locale.set", "domain": "account", "summary": "Set the account-level preferred locale (overrides browser default).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "account.display-preferences.set", "domain": "account", "summary": "Set the account-level theme and timezone.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "account.notifications.get", "domain": "account", "summary": "Read notification preferences.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "account.notifications.update", "domain": "account", "summary": "Update notification preferences.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "account.token.list", "domain": "account", "summary": "List your Personal Access Tokens (PATs).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "account.token.revoke", "domain": "account", "summary": "Revoke a PAT (cannot be disabled — safety floor).", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "account.oauth-grants.list", "domain": "account", "summary": "List active OAuth grants to third-party agents (Claude, ChatGPT, Gemini, etc.).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "account.oauth-grants.revoke", "domain": "account", "summary": "Revoke an OAuth grant. The third-party agent's tokens are immediately invalidated.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "account.security-log.list", "domain": "account", "summary": "Read the account-level security log (logins, MFA, key issuance, anomalies).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "account.delete", "domain": "account", "summary": "Schedule account deletion after a grace window (30 days by default). Organizations you solely own are scheduled with it; ones with other members are reported back instead. Requires WebAuthn step-up.", "safety_level": "destructive", "confirmation_policy": "mandate", "idempotent": false, "rate_class": "default" }, { "id": "org.get", "domain": "org", "summary": "Get the current organization's details.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "org.update", "domain": "org", "summary": "Update organization name + locale.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "org.locale.set", "domain": "org", "summary": "Set the organization-default locale (inherited by new workspaces).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "org.billing-state.get", "domain": "org", "summary": "Get the org's current billing state (plan, subscription status, add-ons).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "org.member.list", "domain": "org", "summary": "List organization members.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "org.member.invite", "domain": "org", "summary": "Invite a new member to the organization. Sends a verification email.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "org.member.remove", "domain": "org", "summary": "Remove a member from the organization. They lose access to all workspaces immediately.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "org.member.role.change", "domain": "org", "summary": "Change an org member's role.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "org.invitations.list", "domain": "org", "summary": "List pending/expired invitations.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "org.invitations.resend", "domain": "org", "summary": "Resend a pending invitation (subject to 5-minute cooldown).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "org.invitations.revoke", "domain": "org", "summary": "Revoke a pending invitation.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "org.transfer-ownership", "domain": "org", "summary": "Transfer org ownership to another admin. Requires WebAuthn step-up + reason.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "org.delete.schedule", "domain": "org", "summary": "Schedule organization deletion in 30 days. Cancellable within the grace window.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "org.delete.cancel", "domain": "org", "summary": "Cancel a previously-scheduled org deletion (within grace).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "org.audit.list", "domain": "org", "summary": "Read org-level audit log entries (admin actions, member changes, billing).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "org.sso.connections.list", "domain": "org", "summary": "List the organization's SSO connections (SAML/OIDC), with sealed secrets redacted to booleans.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "org.sso.connections.upsert", "domain": "org", "summary": "Create or update a SAML/OIDC SSO connection. A provided OIDC client secret is sealed; SAML certificates are validated.", "safety_level": "mutation", "confirmation_policy": "mandate", "idempotent": false, "rate_class": "default" }, { "id": "org.sso.connections.delete", "domain": "org", "summary": "Delete an SSO connection by id (org-scoped).", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "org.sso.domains.list", "domain": "org", "summary": "List the organization's captured SSO domains (verified state + the DNS TXT record to publish).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "org.sso.domains.create", "domain": "org", "summary": "Claim an email domain for SSO and mint its DNS TXT verification challenge.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "org.sso.domains.verify", "domain": "org", "summary": "Verify a claimed domain via a DNS-over-HTTPS TXT lookup (proof of control).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "org.sso.domains.enforcement", "domain": "org", "summary": "Toggle SSO enforcement for a verified domain (requires a verified domain + an active connection).", "safety_level": "mutation", "confirmation_policy": "mandate", "idempotent": false, "rate_class": "default" }, { "id": "org.sso.domains.delete", "domain": "org", "summary": "Remove a captured SSO domain (org-scoped).", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "org.sso.scim-tokens.list", "domain": "org", "summary": "List a connection's SCIM bearer tokens (hash-only; the raw token is never returned).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "org.sso.scim-tokens.mint", "domain": "org", "summary": "Mint a SCIM 2.0 bearer token for a connection. The RAW token is returned exactly once; only its hash is stored.", "safety_level": "mutation", "confirmation_policy": "mandate", "idempotent": false, "rate_class": "default" }, { "id": "org.sso.scim-tokens.revoke", "domain": "org", "summary": "Revoke a SCIM bearer token by id.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "workspace.list", "domain": "workspace", "summary": "List all workspaces in the current organization.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "workspace.get", "domain": "workspace", "summary": "Get the full state of a single workspace by id.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "workspace.create", "domain": "workspace", "summary": "Create a new workspace in the current organization.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "workspace.update", "domain": "workspace", "summary": "Update workspace settings (name, retention, locale, Tools controls).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "workspace.rename", "domain": "workspace", "summary": "Rename a workspace (convenience alias of workspace.update).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "workspace.delete.schedule", "domain": "workspace", "summary": "Schedule a workspace for deletion in 30 days (grace period).", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "workspace.delete.cancel", "domain": "workspace", "summary": "Cancel a previously-scheduled workspace deletion (within grace).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "workspace.region.binding-proof", "domain": "workspace", "summary": "Download the OpenTimestamps proof of the workspace's region binding.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "workspace.member.list", "domain": "workspace", "summary": "List members of a workspace with their roles.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "workspace.member.add", "domain": "workspace", "summary": "Add an organization member to a workspace with a specific role.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "workspace.member.role.change", "domain": "workspace", "summary": "Change a workspace member's role.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "workspace.member.remove", "domain": "workspace", "summary": "Remove a member from a workspace.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "workspace.transfer-ownership", "domain": "workspace", "summary": "Transfer workspace ownership to another admin.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "workspace.attestor.enable", "domain": "workspace", "summary": "Enable Attestor on a workspace (requires an org-level Attestor subscription).", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": true, "rate_class": "billing" }, { "id": "workspace.attestor.disable", "domain": "workspace", "summary": "Disable Attestor on a workspace.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "workspace.regions.list", "domain": "workspace", "summary": "List the available regions a workspace can be created in.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.subscription.get", "domain": "billing", "summary": "Get the org's current subscription.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.subscription.upgrade", "domain": "billing", "summary": "Upgrade to a higher tier. Prorates charges; takes effect immediately.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.subscription.downgrade", "domain": "billing", "summary": "Downgrade to a lower tier. Effective at next billing period.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.subscription.cancel", "domain": "billing", "summary": "Cancel subscription at current period end. Workspace remains accessible until then.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.subscription.reactivate", "domain": "billing", "summary": "Reactivate a subscription that's been scheduled to cancel.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": true, "rate_class": "billing" }, { "id": "billing.invoices.list", "domain": "billing", "summary": "List invoices.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.invoices.get", "domain": "billing", "summary": "Get a single invoice.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.invoices.download", "domain": "billing", "summary": "Get a signed download URL for the invoice PDF.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.payment-method.get", "domain": "billing", "summary": "Get the current default payment method (masked).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.payment-method.update-url", "domain": "billing", "summary": "Get a signed URL to the hosted payment-method update page. The update happens there, not in Agined.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "billing.packs.list", "domain": "billing", "summary": "List available top-up packs (runs, Number One queries, Tools calls).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.packs.purchase", "domain": "billing", "summary": "Purchase a top-up pack.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.auto-topup.get", "domain": "billing", "summary": "Get auto-topup configuration.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.auto-topup.configure", "domain": "billing", "summary": "Configure auto-topup. Fires when balance drops below threshold; capped at monthly USD limit.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.cost-centers.list", "domain": "billing", "summary": "List org cost centers (for tagging charges + per-cost-center invoicing).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.cost-centers.create", "domain": "billing", "summary": "Create a cost center.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "billing.cost-centers.update", "domain": "billing", "summary": "Update a cost center.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "billing.cost-centers.delete", "domain": "billing", "summary": "Delete a cost center. Tagged charges keep historical tag.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "billing.notarian.subscribe", "domain": "billing", "summary": "Subscribe to the Notarian add-on (per-tier subscription pricing).", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.notarian.unsubscribe", "domain": "billing", "summary": "Unsubscribe from Notarian at next billing period.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.retention-extension.unsubscribe", "domain": "billing", "summary": "Cancel the paid retention extension. Coverage continues until the paid-through date.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.multi-workspace.subscribe", "domain": "billing", "summary": "Subscribe the organization to the multi-workspace add-on, allowing more than one workspace.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.multi-workspace.unsubscribe", "domain": "billing", "summary": "Cancel the multi-workspace add-on at the end of the current period.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.infinite-memory.subscribe", "domain": "billing", "summary": "Subscribe to the Infinite Memory add-on for Number One ($19/mo on paid tiers).", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.infinite-memory.unsubscribe", "domain": "billing", "summary": "Unsubscribe Infinite Memory at next billing period.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.retention-extension.subscribe", "domain": "billing", "summary": "Subscribe to the universal paid retention extension. Convenience alias of retention.extension.subscribe.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.attestor.tier.set", "domain": "billing", "summary": "Set the Attestor subscription tier for the org.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.attestor.tier.get", "domain": "billing", "summary": "Get the current Attestor tier.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.attestor.top-up.purchase", "domain": "billing", "summary": "Purchase an Attestor top-up pack (extra call quota for the current month).", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.attestor.auto-overage.set", "domain": "billing", "summary": "Configure auto-overage for an Attestor-enabled workspace.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.attestor.billing-mode.set", "domain": "billing", "summary": "Set the Attestor billing mode (combined vs separate subscription).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "billing.attestor.usage.current", "domain": "billing", "summary": "Get current Attestor usage for the org (calls used + remaining quota + auto-overage status).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "billing.ledger-bundles.subscribe", "domain": "billing", "summary": "Subscribe to the LedgerBundles add-on (per-tier subscription pricing).", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "billing.ledger-bundles.unsubscribe", "domain": "billing", "summary": "Unsubscribe from LedgerBundles at next billing period.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "keys.list", "domain": "keys", "summary": "List workspace API keys (active + revoked filter).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "keys.get", "domain": "keys", "summary": "Get a single workspace API key by id.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "keys.issue", "domain": "keys", "summary": "Issue a new workspace API key. Cleartext returned ONCE.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "keys.revoke", "domain": "keys", "summary": "Revoke a workspace API key. Propagates in ≤30s.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "keys.rotate", "domain": "keys", "summary": "Rotate a key: revoke the current value + issue a replacement with the same label + scopes. Cleartext returned ONCE.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "keys.scopes.list", "domain": "keys", "summary": "List the available scope grants for workspace API keys.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "keys.usage.get", "domain": "keys", "summary": "Get usage statistics (calls + last-used + IP CIDRs) for a key over a time window.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "expensive" }, { "id": "keys.last-used.get", "domain": "keys", "summary": "Quick lookup: when was this key last used?", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "keys.attestor.list", "domain": "keys", "summary": "Convenience: list only the Attestor-product workspace keys.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "keys.attestor.issue", "domain": "keys", "summary": "Issue an Attestor-product workspace key (atst_*). Cleartext shown ONCE.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "keys.ingest-secret.list", "domain": "keys", "summary": "List this workspace's ingest secrets (metadata only — never the secret value).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "keys.ingest-secret.issue", "domain": "keys", "summary": "Issue an ingest secret for a platform. Any active secret for that platform is revoked. Cleartext returned ONCE.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "keys.ingest-secret.revoke", "domain": "keys", "summary": "Revoke an ingest secret without issuing a replacement. Deliveries for that platform then fail closed.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "webhooks.list", "domain": "webhooks", "summary": "List webhook endpoints for a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "webhooks.get", "domain": "webhooks", "summary": "Get a single webhook endpoint.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "webhooks.create", "domain": "webhooks", "summary": "Register a new webhook endpoint. Returns the signing secret cleartext ONCE.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "webhooks.update", "domain": "webhooks", "summary": "Update a webhook's URL, label, or event subscriptions.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "webhooks.delete", "domain": "webhooks", "summary": "Delete a webhook endpoint. Pending deliveries are abandoned.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "webhooks.enable", "domain": "webhooks", "summary": "Enable or disable a webhook without deleting it.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "webhooks.test-fire", "domain": "webhooks", "summary": "Fire a synthetic test event to a webhook to verify delivery + signature validation.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "webhooks.events.list", "domain": "webhooks", "summary": "List the event types this webhook can subscribe to (from the AsyncAPI 3 spec).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "webhooks.events.replay", "domain": "webhooks", "summary": "Replay missed events from a time window. Useful for recovering after webhook downtime.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "expensive" }, { "id": "webhooks.signing-secret.rotate", "domain": "webhooks", "summary": "Rotate the HMAC signing secret. Old secret valid for 24h grace.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "webhooks.deliveries.list", "domain": "webhooks", "summary": "List delivery attempts for a webhook (success + failure history).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "webhooks.deliveries.retry", "domain": "webhooks", "summary": "Retry a specific failed delivery.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "alerts.list", "domain": "alerts", "summary": "List alert rules for a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "alerts.get", "domain": "alerts", "summary": "Get a single alert rule.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "alerts.create", "domain": "alerts", "summary": "Create a new alert rule.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "alerts.update", "domain": "alerts", "summary": "Update an alert's label / config / channels / enabled flag.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "alerts.delete", "domain": "alerts", "summary": "Delete an alert rule.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "alerts.enable", "domain": "alerts", "summary": "Enable an alert rule.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "alerts.disable", "domain": "alerts", "summary": "Disable an alert rule without deleting it.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "alerts.test-fire", "domain": "alerts", "summary": "Fire a synthetic test of an alert to verify channels.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "alerts.kinds.list", "domain": "alerts", "summary": "List all supported alert kinds + their config shapes + severity classifications.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "alerts.history.list", "domain": "alerts", "summary": "List historical firings for a given alert rule.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "exports.list", "domain": "exports", "summary": "List exports for a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "exports.get", "domain": "exports", "summary": "Get a single export's status + metadata.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "exports.request", "domain": "exports", "summary": "Request a new compliance export. Returns the export id; status polls reveal readiness.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "expensive" }, { "id": "exports.download", "domain": "exports", "summary": "Get the signed download URL for a ready export (URL is time-bounded; SHA-256 included for integrity check).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "exports.verify", "domain": "exports", "summary": "Verify an export's Ed25519 signature + OTS Bitcoin proof. Offline-verifiable.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "exports.attestor.receipt-bundle.request", "domain": "exports", "summary": "Request a portable Attestor-receipt bundle — JSON manifest + receipt files + public key JWK + verify README. Verifiable with @attestor/verify.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "expensive" }, { "id": "exports.eu-ai-act.article-12.request", "domain": "exports", "summary": "Request an EU AI Act Article 12 compliant log bundle (prEN 18229-1 + ISO/IEC DIS 24970 schema). Cannot be disabled — regulatory mandate.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "expensive" }, { "id": "exports.audit-log.request", "domain": "exports", "summary": "Request a JSON or CSV export of the workspace audit log filtered by time + kind.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "expensive" }, { "id": "exports.kinds.list", "domain": "exports", "summary": "List the supported export kinds + their output formats + retention.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "exports.delete", "domain": "exports", "summary": "Delete a completed export (frees R2 storage immediately).", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "retention.policy.get", "domain": "retention", "summary": "Get the active retention policy for a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "retention.policy.update", "domain": "retention", "summary": "Update workspace retention days (within tier limits).", "safety_level": "destructive", "confirmation_policy": "mandate", "idempotent": false, "rate_class": "default" }, { "id": "retention.histogram.get", "domain": "retention", "summary": "Get a histogram of record ages in the workspace (helps visualize what's near purge).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "expensive" }, { "id": "retention.next-purge.preview", "domain": "retention", "summary": "Preview which records will purge in the next cycle (live 1-Hz countdown on the dashboard).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "retention.purge-history.list", "domain": "retention", "summary": "List historical purge events with verification status.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "retention.extension.subscribe", "domain": "retention", "summary": "Subscribe to the paid retention extension at the per-tier rate.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "retention.extension.get", "domain": "retention", "summary": "Get the current retention extension subscription (if any).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "retention.extension.update", "domain": "retention", "summary": "Update the active retention extension (change duration).", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "retention.extension.cancel", "domain": "retention", "summary": "Cancel the retention extension at the end of the current billing period.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "retention.extension.rates.list", "domain": "retention", "summary": "List the per-tier retention extension rates (USD cents per GB per month).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "retention.policy.suggested-tier.get", "domain": "retention", "summary": "Recommend a higher tier if the workspace's data growth + retention needs make extension uneconomical.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "retention.audit.list", "domain": "retention", "summary": "List retention-policy audit events (changes, purges, extensions).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "audit.workspace.list", "domain": "audit", "summary": "List audit log entries for a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "expensive" }, { "id": "audit.workspace.get", "domain": "audit", "summary": "Get a specific audit entry by id.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "audit.workspace.search", "domain": "audit", "summary": "Full-text search across a workspace's audit log.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "expensive" }, { "id": "audit.workspace.share", "domain": "audit", "summary": "Generate a time-bounded share URL to an audit entry (for external auditors).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "audit.workspace.shares.list", "domain": "audit", "summary": "List the audit share links minted for this workspace, with their expiry and revocation state.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "audit.workspace.share.revoke", "domain": "audit", "summary": "Revoke an audit share link immediately, before its expiry.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "audit.custody.list", "domain": "audit", "summary": "List custody chain entries for a workspace (hash-chained, Ed25519-signed).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "expensive" }, { "id": "audit.custody.get", "domain": "audit", "summary": "Get a custody entry by id (hash-chained via prevHash→entryHash; per-entry signature is optional — the Ed25519 seal covers a range, not each entry).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "audit.tops.list", "domain": "audit", "summary": "List Tops feed entries (hash-chained per entry; authenticity is the periodically Ed25519-signed + OTS Bitcoin-anchored SEAL ROOT — per-entry signature is null until its seal exists).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "expensive" }, { "id": "audit.tops.verify", "domain": "audit", "summary": "Verify the hash chain of this workspace's Tops entries.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "expensive" }, { "id": "audit.shadow-sessions.list", "domain": "audit", "summary": "List Agined-staff shadow-mode sessions on a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "audit.shadow-sessions.get", "domain": "audit", "summary": "Get full details + action feed of a shadow-mode session.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "audit.aggregate", "domain": "audit", "summary": "Group + count audit entries by a dimension (kind, transport, outcome, agentClientId).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "expensive" }, { "id": "audit.kinds.list", "domain": "audit", "summary": "List all audit-kind discriminator values supported by the platform.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "audit.export.scoped", "domain": "audit", "summary": "Request a scoped CSV/JSON export of audit entries matching filters. Returns a download URL when ready (signed, time-bounded).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "expensive" }, { "id": "audit.outside-access.list", "domain": "audit", "summary": "List entries representing access from outside the workspace's normal principals (admin reads, side-car reads, share-url access).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "audit.stream.list", "domain": "audit", "summary": "List the workspace's SIEM/S3 audit-stream destinations (Splunk HEC / Datadog / webhook / S3), with sealed credentials masked.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "audit.stream.configure", "domain": "audit", "summary": "Create or update a SIEM/S3 audit-stream destination. A provided vendor token / S3 secret / webhook secret is sealed at rest.", "safety_level": "mutation", "confirmation_policy": "mandate", "idempotent": false, "rate_class": "default" }, { "id": "audit.stream.delete", "domain": "audit", "summary": "Delete an audit-stream destination by id (workspace-scoped).", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "tops.config.get", "domain": "tops", "summary": "Get the Tops config for a specific scope (org, workspace, or actor).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "tops.config.set", "domain": "tops", "summary": "Set the Tops config for a scope. Forensic detail level requires explicit acknowledgement.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "tops.config.delete", "domain": "tops", "summary": "Delete a scope-level Tops config (scope reverts to parent inheritance).", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "tops.config.list", "domain": "tops", "summary": "List Tops configs (all scopes in an org or workspace).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "tops.config.cascade.resolve", "domain": "tops", "summary": "Resolve the effective Tops config at a specific (org, workspace, actor) leaf — applies the leaf-wins cascade.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "tops.config.preset.apply", "domain": "tops", "summary": "Apply one of the 3 presets (Minimal / Recommended / Forensic) to a scope.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "tops.config.presets.list", "domain": "tops", "summary": "List the 3 supported presets with their config shapes + tradeoff labels.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "tops.config.testbed.run", "domain": "tops", "summary": "Test the cascade resolver against a synthetic actor id to preview what entries it would generate.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "tops.config.change-history.list", "domain": "tops", "summary": "List Tops-config change events (audit cross-link).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "tops.config.sparkline.get", "domain": "tops", "summary": "Get a 30-day sparkline of Tops detail-level changes (visualizes forensic-cooldown nudge).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "tops.config.audit-cross-links.get", "domain": "tops", "summary": "Get deep-links to the workspace audit log filtered by Tops-config-change events.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "tops.config.cooldown-status.get", "domain": "tops", "summary": "Check if a scope is in the forensic cooldown window (auto-revert nudge).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "tops.specimen.get", "domain": "tops", "summary": "Read this workspace's public trust page settings. `null` when nothing has ever been published.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "tops.specimen.set", "domain": "tops", "summary": "Claim or rename the workspace's public handle, and turn the page on or off.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "tops.specimen.delete", "domain": "tops", "summary": "Take the public page down and RELEASE the handle for anyone else to claim.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "referrals.code.get", "domain": "referrals", "summary": "Get your active referral code + share URL.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "referrals.code.regenerate", "domain": "referrals", "summary": "Regenerate referral code. Old code stops working.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "referrals.share-message.set", "domain": "referrals", "summary": "Set the message shared alongside your referral link.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "referrals.share.record", "domain": "referrals", "summary": "Record that you shared your referral link, and where.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "referrals.list-sent", "domain": "referrals", "summary": "List referrals you have sent.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "referrals.list-received", "domain": "referrals", "summary": "List referrals where you were the referee.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "referrals.balance.get", "domain": "referrals", "summary": "Get your current point balance + lifetime multiplier tier.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "referrals.funnel.get", "domain": "referrals", "summary": "Get conversion funnel analytics (sent → clicked → joined → redeemed).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "referrals.redeem", "domain": "referrals", "summary": "Redeem a referral or voucher code.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "referrals.spend", "domain": "referrals", "summary": "Spend points on a reward (run pack, add-on credit, Every.org charity, etc.).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "referrals.spend-products.list", "domain": "referrals", "summary": "List the products you can redeem points against.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "referrals.ledger.list", "domain": "referrals", "summary": "List point transactions (earned + spent).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "number_one.conversation.create", "domain": "number_one", "summary": "Start a new Number One conversation.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "number_one.conversation.list", "domain": "number_one", "summary": "List your conversations (most recent first).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "number_one.conversation.get", "domain": "number_one", "summary": "Get a conversation's metadata + recent messages.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "number_one.conversation.delete", "domain": "number_one", "summary": "Delete a conversation. Memory facts attached to it survive but lose conversation context.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "number_one.message.send", "domain": "number_one", "summary": "Send a user message in a Number One conversation. Returns the full buffered assistant turn.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "expensive" }, { "id": "number_one.message.list", "domain": "number_one", "summary": "List messages in a conversation.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "number_one.mode.set", "domain": "number_one", "summary": "Switch a conversation's mode (Calculator / Analyst / Admin).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "number_one.memory.list", "domain": "number_one", "summary": "List memory facts pinned in a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "number_one.memory.pin", "domain": "number_one", "summary": "Pin a memory fact so Number One reliably recalls it across conversations. Pass factId to re-pin an existing fact, or text (optionally with conversationId provenance) to create + pin a new one.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "number_one.memory.unpin", "domain": "number_one", "summary": "Unpin a memory fact.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "number_one.memory.erase", "domain": "number_one", "summary": "Permanently erase a memory-ledger turn's content (ADR-014 marker — the redaction cannot be undone). memoryId is a message id from message.list; pinned facts are managed via memory.unpin instead.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "number_one.memory.cap.get", "domain": "number_one", "summary": "Get the workspace's memory usage + cap. The ledger is byte-capped (Z-07); capBytes is -1 when the Infinite Memory add-on is active.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "number_one.llm-billing.get", "domain": "number_one", "summary": "Read whether this workspace's Number One calls run on Agined's LLM key (metered) or on its own provider key (BYOK, not metered).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "number_one.llm-billing.set", "domain": "number_one", "summary": "Choose whether this workspace's Number One calls run on Agined's LLM key (metered) or on its own provider key (BYOK, not metered).", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "number_one.analyst.get", "domain": "number_one", "summary": "Read whether Analyst mode is enabled for this workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "number_one.analyst.set", "domain": "number_one", "summary": "Turn Analyst mode on or off for everyone in this workspace.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "number_one.assistant-posture.get", "domain": "number_one", "summary": "Read which posture the assistant runs in for this workspace — membrane-protected, in-boundary or off — and which model provider its calls go to.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "number_one.assistant-posture.set", "domain": "number_one", "summary": "Choose the assistant's posture for this workspace, and which model provider its calls go to.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "attestor.attest.agent-call", "domain": "attestor", "summary": "Issue an Attestor receipt for an agent.call primitive (outbound API call by a customer's agent).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "attestor.attest.content", "domain": "attestor", "summary": "Attest a content blob (text, image hash, document). Returns a signed receipt.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "attestor.attest.llm", "domain": "attestor", "summary": "Attest an LLM inference (model + prompt hash + response hash + provider).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "attestor.attest.commit", "domain": "attestor", "summary": "Attest a Git commit (commit hash + author + repo URL). Pairs with the @attestor/attest-commit GitHub Action.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "attestor.deliver.webhook", "domain": "attestor", "summary": "Issue a receipt for an outbound webhook delivery attempt.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "attestor.monitor.http.add", "domain": "attestor", "summary": "Register a new HTTP monitor (1-minute minimum interval).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "attestor.monitor.http.list", "domain": "attestor", "summary": "List HTTP monitors in a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.monitor.http.run-now", "domain": "attestor", "summary": "Run a monitor check immediately (bypasses the scheduled interval).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "expensive" }, { "id": "attestor.monitor.http.remove", "domain": "attestor", "summary": "Delete an HTTP monitor.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "attestor.watch.dns.add", "domain": "attestor", "summary": "Register a DNS watch (detects record drift; signs every check as a receipt).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "attestor.watch.dns.list", "domain": "attestor", "summary": "List DNS watches in a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.watch.dns.remove", "domain": "attestor", "summary": "Delete a DNS watch.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "attestor.watch.tls.add", "domain": "attestor", "summary": "Register a TLS certificate watch (detects cert changes; signs every check).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "attestor.watch.tls.list", "domain": "attestor", "summary": "List TLS watches in a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.watch.tls.remove", "domain": "attestor", "summary": "Delete a TLS watch.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "attestor.receipt.list", "domain": "attestor", "summary": "List Attestor receipts for a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.receipt.get", "domain": "attestor", "summary": "Get a single receipt with full body.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.receipt.verify", "domain": "attestor", "summary": "Verify a receipt's Ed25519 signature against the published public key. Cannot be disabled.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.usage.current", "domain": "attestor", "summary": "Get current-period Attestor usage for a workspace (calls per primitive + budget consumed).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.usage.historical", "domain": "attestor", "summary": "Get historical Attestor usage (per-day breakdown for a date range).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "expensive" }, { "id": "attestor.subscription.get", "domain": "attestor", "summary": "Get workspace Attestor subscription state.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.subscription.cancel", "domain": "attestor", "summary": "Cancel the Attestor subscription at the next billing period. Workspace's existing receipts remain accessible.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "attestor.abuse-status.get", "domain": "attestor", "summary": "Get the current Attestor abuse status for a workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.abuse-status.appeal", "domain": "attestor", "summary": "Submit an appeal against an abuse-status flag or suspension.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "attestor.signing-key.get", "domain": "attestor", "summary": "Get the current active Attestor signing key id for the workspace's jurisdiction.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.signing-key.list", "domain": "attestor", "summary": "List all signing keys (active + historical) usable to verify the workspace's receipts.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.signing-key.rotate-request", "domain": "attestor", "summary": "Request signing-key rotation (Enterprise tier dedicated keys only). Agined ops fulfils via key ceremony.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "attestor.signing-key.public.get", "domain": "attestor", "summary": "Get the public-key JWK for a specific signing key id (for offline verification).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.status.get", "domain": "attestor", "summary": "Get the Attestor subsystem health (per-jurisdiction Worker uptime, per-primitive error rate, last self-attestation receipt).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "attestor.attestation-feed.get", "domain": "attestor", "summary": "Get the daily Attestor self-attestation receipt feed (Agined attesting to its own platform integrity).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "starfleet.run", "domain": "starfleet", "summary": "Post a run to a Starfleet spot actor (witness/council/historian/custodian/conscience/…) — observe + decide + anchor it in the workspace hash-chain.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "starfleet.runs.list", "domain": "starfleet", "summary": "List the workspace's Starfleet runs (actor IS the surface: witness | historian | custodian | conscience | …).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "starfleet.actors.list", "domain": "starfleet", "summary": "List the Starfleet roster (optionally for one version) with each actor's min tier.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "starfleet.agents.list", "domain": "starfleet", "summary": "List the workspace's posting agents (distinct agent DIDs across runs, with counts + last-seen).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "starfleet.runs.verify-chain", "domain": "starfleet", "summary": "Verify the integrity of the workspace's run hash-chain from a starting sequence.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "expensive" }, { "id": "starfleet.runs.diff", "domain": "starfleet", "summary": "Compare two Starfleet runs (classification + payload diff).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "starfleet.runs.replay", "domain": "starfleet", "summary": "Reconstruct + re-verify a single run from its chain entry.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "ledger-bundles.snapshot.create", "domain": "ledger-bundles", "summary": "Create a signed LedgerBundles snapshot of the workspace's audit state (a paid action).", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "ledger-bundles.verify-chain", "domain": "ledger-bundles", "summary": "Verify the LedgerBundles transparency chain (free — a transparency guarantee).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "ledger-bundles.anchors.list", "domain": "ledger-bundles", "summary": "List the LedgerBundles anchors (the published chain checkpoints).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "privacy.dsr.submit", "domain": "privacy", "summary": "Submit a data-subject request (GDPR / CCPA). Cannot be disabled — statutory right.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "privacy.dsr.status", "domain": "privacy", "summary": "Check status of a submitted DSR. Cannot be disabled — statutory right.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "privacy.dsr.list", "domain": "privacy", "summary": "List all DSRs filed for this account / workspace.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "privacy.export.request", "domain": "privacy", "summary": "Request a personal-data export (GDPR Art. 20 — data portability). Cannot be disabled.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "expensive" }, { "id": "privacy.export.download", "domain": "privacy", "summary": "Get a signed download URL for a completed personal-data export.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "privacy.subject-rights.list", "domain": "privacy", "summary": "List the data-subject rights Agined honours (GDPR, CCPA, LGPD) + the legal references.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "support.tickets.list", "domain": "support", "summary": "List your support tickets.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "support.tickets.create", "domain": "support", "summary": "Open a new support ticket.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "support.tickets.get", "domain": "support", "summary": "Get a ticket's details + reply thread.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "support.tickets.reply", "domain": "support", "summary": "Post a reply to a ticket.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "support.tickets.close", "domain": "support", "summary": "Close a ticket (optionally with a reason).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "support.satisfaction.rate", "domain": "support", "summary": "Rate the support experience after a ticket closes — five dimensions, 1–5 each (ADR-034). A 2-or-below on any dimension triggers the feedback loop.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "discovery.capabilities.get", "domain": "discovery", "summary": "Get the full action registry catalogue (machine-readable). Same content as `/api/v1/actions.json`.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "discovery.version.get", "domain": "discovery", "summary": "Get the platform version + contracts package version + supported MCP / OpenAPI spec versions.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "discovery.schema.get", "domain": "discovery", "summary": "Get the JSON Schema for a specific action's input or output.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "discovery.locales.list", "domain": "discovery", "summary": "List supported user-facing locales.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "discovery.plans.list", "domain": "discovery", "summary": "List the available Agined + Tools subscription plans.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "discovery.regions.list", "domain": "discovery", "summary": "List the 32 data-residency regions a workspace can be bound to.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "discovery.confirmation.token.verify", "domain": "discovery", "summary": "Verify a confirmation token is well-formed + still valid (cannot be disabled — safety floor).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "agents.identity.enroll", "domain": "agents", "summary": "Enroll a new W3C DID Web agent identity under your principal.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "agents.identity.list", "domain": "agents", "summary": "List enrolled agent DIDs visible to the principal.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "agents.identity.get", "domain": "agents", "summary": "Get one enrolled agent DID with full document + rotation history.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "agents.identity.rotate", "domain": "agents", "summary": "Rotate the signing key for an agent DID. Old key kept active for a cooldown period.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "agents.identity.revoke", "domain": "agents", "summary": "Permanently revoke an agent DID. Cannot be undone; the DID id cannot be re-enrolled.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "agents.identity.did.resolve", "domain": "agents", "summary": "Resolve any DID (did:web, did:key, did:peer) and return the resolution result envelope.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "agents.identity.delegate", "domain": "agents", "summary": "Issue an A2A delegation token granting a remote partner DID a scope subset on your behalf.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "agents.identity.delegate.revoke", "domain": "agents", "summary": "Revoke an A2A delegation. Flips its bit in the published BitstringStatusList.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "agents.identity.delegate.verify", "domain": "agents", "summary": "Verify a presented A2A delegation credential. Returns ok, or a structured reason.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "agents.identity.authority.get", "domain": "agents", "summary": "Resolve who an agent acts on behalf of, from verified identity rather than operator configuration.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "agents.mandate.issue", "domain": "agents", "summary": "Issue an AP2 Verifiable Credential mandate authorising an agent up to spend / volume limits.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "agents.mandate.list", "domain": "agents", "summary": "List mandates issued under the principal.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "agents.mandate.verify", "domain": "agents", "summary": "Verify a presented mandate VC against an action request. Returns ok or a structured reason.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "agents.mandate.revoke", "domain": "agents", "summary": "Revoke a mandate, and every A2A delegation the agent issued under it (the kill chain). Goes into the BitstringStatusList revocation register immediately.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "agents.spiffe.bind", "domain": "agents", "summary": "Bind a SPIFFE ID to an agent DID so its JWT-SVIDs can attest as that agent.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "agents.spiffe.unbind", "domain": "agents", "summary": "Unbind a SPIFFE ID from its agent DID so its SVIDs stop attesting as that agent.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "agents.spiffe.workload.attest", "domain": "agents", "summary": "Exchange a SPIFFE SVID for a short-lived DPoP-bound Agined session.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "agents.trusted-roots.list", "domain": "agents", "summary": "List partner organization DIDs the workspace accepts as A2A federation roots.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "agents.trusted-roots.add", "domain": "agents", "summary": "Add a partner organization DID to the trusted-roots list for this workspace.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "agents.trusted-roots.remove", "domain": "agents", "summary": "Remove a partner organization DID from the trusted-roots list for this workspace.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "fabric.retrieve.signed", "domain": "fabric", "summary": "Query the fabric and seal the result as a signed-retrieval receipt — the query hash plus every returned record's content hash, so a grounded claim can be proved after the fact.", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "fabric.memory.snapshot", "domain": "fabric", "summary": "Snapshot the fabric's records as a signed memory-attestation receipt — entry count, Merkle root over every entry's content hash, and the provenance window — so an export can be verified without trusting the exporter.", "safety_level": "billing_impacting", "confirmation_policy": "mandate", "idempotent": false, "rate_class": "billing" }, { "id": "fabric.sources.catalog", "domain": "fabric", "summary": "List the connectable source catalog — each source's category, purpose, auth method, and the engine classes it contributes.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "fabric.connections.connect", "domain": "fabric", "summary": "Connect a catalog source (BYO credentials) into the fabric. The connection's records broadcast to every subscribing product.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "fabric.connections.list", "domain": "fabric", "summary": "List the workspace's fabric connections with their sync health.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "fabric.connections.sync", "domain": "fabric", "summary": "Enqueue an on-demand sync + re-extraction of a fabric connection.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "fabric.connections.revoke", "domain": "fabric", "summary": "Revoke a fabric connection — purges its extracted records per the platform's data-handling terms.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "fabric.webhooks.list", "domain": "fabric", "summary": "List the workspace's inbound webhook endpoints, with which sources can push and whether each scheme binds the body.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "fabric.webhooks.open", "domain": "fabric", "summary": "Open an inbound webhook endpoint for a connection — returns the signing secret ONCE.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "fabric.webhooks.revoke", "domain": "fabric", "summary": "Revoke an inbound webhook endpoint — deliveries to it stop immediately.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "fabric.records.query", "domain": "fabric", "summary": "Query extracted records by kind / source / subscriber — the universal read every product (and agent) uses to consume the fabric.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "fabric.subscriptions.matrix", "domain": "fabric", "summary": "Return the fabric subscription matrix — which product consumes which record kinds, and how many products each kind powers.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "actionflow.flows.list", "domain": "actionflow", "summary": "List the workspace's ActionFlow flows.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "actionflow.flows.run", "domain": "actionflow", "summary": "Run a flow — trigger an execution through the bounded graph engine.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "actionflow.flows.publish", "domain": "actionflow", "summary": "Publish a flow (make the current draft the live version).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "actionflow.flows.deprecate", "domain": "actionflow", "summary": "Retire a published flow. It stops running on its triggers; its execution history is kept.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "actionflow.templates.list", "domain": "actionflow", "summary": "List the ActionFlow starter templates.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "actionflow.templates.instantiate", "domain": "actionflow", "summary": "Instantiate a template into a new draft flow in the workspace.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "actionflow.executions.list", "domain": "actionflow", "summary": "List recent ActionFlow executions.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "lens.list", "domain": "lens", "summary": "List the available compliance-evidence lenses.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "lens.execute", "domain": "lens", "summary": "Execute a lens over the audit chain — produces a signed compliance-evidence bundle (a paid action).", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "lens.validate", "domain": "lens", "summary": "Validate a lens definition (dry-run; no evidence bundle, no charge).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "lens.results.list", "domain": "lens", "summary": "List prior lens-execution results (the evidence-bundle history).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "lens.custom.list", "domain": "lens", "summary": "List the custom lenses this workspace has authored.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "lens.custom.get", "domain": "lens", "summary": "Read one custom lens definition.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "lens.custom.create", "domain": "lens", "summary": "Author a custom lens. The runtime sanitises the definition and refuses an invalid one with the specific errors.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "lens.custom.update", "domain": "lens", "summary": "Replace a custom lens definition.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "lens.custom.delete", "domain": "lens", "summary": "Delete a custom lens. Its past results keep the definition hash they were produced under.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": false, "rate_class": "default" }, { "id": "lens.marketplace.list", "domain": "lens", "summary": "Browse the lens marketplace, with what this workspace has published and installed.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "lens.marketplace.publish", "domain": "lens", "summary": "Publish one of the workspace's own custom lenses at its pinned version. Enterprise only.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": false, "rate_class": "default" }, { "id": "lens.marketplace.unpublish", "domain": "lens", "summary": "Withdraw a listing. It leaves the catalogue; workspaces that already installed it keep the lens.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "lens.marketplace.install", "domain": "lens", "summary": "Install a listing into this workspace as a custom lens, pinned to the published version.", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "lens.marketplace.uninstall", "domain": "lens", "summary": "Remove an installed lens and its install receipt together — the inverse of install.", "safety_level": "destructive", "confirmation_policy": "always", "idempotent": true, "rate_class": "default" }, { "id": "notarian.snapshot.create", "domain": "notarian", "summary": "Create a signed Notarian snapshot of the workspace's audit state (a paid action).", "safety_level": "billing_impacting", "confirmation_policy": "always", "idempotent": false, "rate_class": "billing" }, { "id": "notarian.verify-chain", "domain": "notarian", "summary": "Verify the Notarian transparency chain (free — a transparency guarantee).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "notarian.anchors.list", "domain": "notarian", "summary": "List the Notarian anchors (the published chain checkpoints).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "witness.frameworks.list", "domain": "witness", "summary": "List the supported agent-framework catalog (~180 frameworks) with status, category, and integration pattern — the platform-wide registry, not product-scoped.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "witness.frameworks.get", "domain": "witness", "summary": "Get one agent framework's catalog entry (support status, integration pattern, SDK package, docs).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "witness.patterns.list", "domain": "witness", "summary": "List the 9 integration patterns an agent runtime can attach through (SDK, webhook, OAuth polling, cloud event, OTel, MCP server, LLM proxy, browser instrument, proprietary).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "witness.subscriptions.get", "domain": "witness", "summary": "Get the Witness-Fabric subscription matrix — which products consume which record event classes from the neutral stream.", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "witness.records.list", "domain": "witness", "summary": "List the workspace's adapter-captured agent records from the neutral Witness-Fabric store (chain-free read — product-independent; no enrollment required).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" }, { "id": "witness.records.post", "domain": "witness", "summary": "Post an adapter record directly onto the neutral Witness-Fabric plane (stored chain-free + fanned out to subscribing products; NOT anchored in Agined's Tops chain — use the ingest lane for evidentiary anchoring).", "safety_level": "mutation", "confirmation_policy": "ask", "idempotent": true, "rate_class": "default" }, { "id": "witness.records.stats", "domain": "witness", "summary": "Aggregate stats over the workspace's neutral witness stream (totals + per-framework / per-pattern / per-event counts).", "safety_level": "read", "confirmation_policy": "none", "idempotent": true, "rate_class": "default" } ], "meta": { "generated_at": "2026-11-10T21:32:07.834Z", "contracts_version": "0.32.289-agined.1", "tool_count": 337 } }