diff --git a/Directory.Build.props b/Directory.Build.props index 2e31cbd9..082205e6 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -1,7 +1,7 @@ 0.1.2 - beta.10 + beta.11 $(VersionPrefix) $(VersionPrefix)-$(VersionSuffix) diff --git a/docs/contracts/README.md b/docs/contracts/README.md index 6f801125..c88385e1 100644 --- a/docs/contracts/README.md +++ b/docs/contracts/README.md @@ -5,10 +5,12 @@ [operation catalog](mcp-operation-catalog.json) and [immutable beta.3 baseline](mcp-operation-catalog-beta3.json) and [beta.4 baseline](mcp-operation-catalog-beta4.json), plus the exact - [beta.7 source baseline](mcp-operation-catalog-beta7.json), with the + [beta.7 source baseline](mcp-operation-catalog-beta7.json) and + [beta.10 baseline](mcp-operation-catalog-beta10.json), with the [current old/new operation mapping](mcp-operation-inventory-delta.json) and [retained beta.4 mapping](mcp-operation-inventory-delta-beta4.json) and - [retained beta.7 mapping](mcp-operation-inventory-delta-beta7.json) + [retained beta.7 mapping](mcp-operation-inventory-delta-beta7.json) and + [retained beta.8 mapping](mcp-operation-inventory-delta-beta8.json) - [System pairing protocol v1](bostec-pairing.v1.md) - [RatelDesk incident-create v1](rateldesk-incident-create.v1.md), [schema](rateldesk-incident-create.v1.json), @@ -16,3 +18,6 @@ [checksums](rateldesk-incident-create.v1.SHA256SUMS) These versioned contracts remain distinct from account-owned browser pairing. +The current catalog is revision `2026-10-25.beta11-contracts-v25`: 390 operations +on 37 tools. Its beta.10-to-beta.11 mapping retains all 389 prior operation +contracts unchanged and adds confirmed inbound email rule deletion. diff --git a/docs/contracts/mcp-operation-catalog-beta10.json b/docs/contracts/mcp-operation-catalog-beta10.json new file mode 100644 index 00000000..dd6f7e1b --- /dev/null +++ b/docs/contracts/mcp-operation-catalog-beta10.json @@ -0,0 +1,68779 @@ +{ + "schemaHash": "fc3603d87ad56fc994cd77385474874a5bc5c9df79a7dc825f5785460463a6f7", + "catalogRevision": "2026-10-20.beta9-contracts-v24", + "catalogHash": "44d767508d35628a4a9c562e842834ad97053435133890646b417edd5b189f74", + "operationCount": 389, + "operations": [ + { + "tool": "helpdesk_auth", + "operation": "status", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/auth/ai-agent/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the authenticated agent status.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Caller-bound integration/gateway uses authenticated /api/v1/auth/me; explicit external Authentik uses /api/v1/auth/ai-agent/status requiring exact AuthentikAiAgent scheme. No target or identity-mode fallback. Use access for current downstream API permissions in either mode.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_auth", + "operation": "access", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/auth/me", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the current downstream execution principal\u0027s API permissions, organization scope and linked customer; external HTTP ingress identity remains separate.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated /api/v1/auth/me resolves current execution-principal authority in every credential mode. In external HTTP mode this is the separately configured shared downstream principal, not the ingress caller. Discovery configuration does not imply HelpdeskAdmin or exact AI authority.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_health", + "operation": "get", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/health/live, /health/ready, /api/v1/auth/ai-agent/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read live, ready, and authenticated health.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Backend live/ready probes are public; authenticated probe uses /auth/me for caller-bound integration/gateway or exact AuthentikAiAgent status for explicit external Authentik. MCP ingress still requires its configured identity.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_config", + "operation": "show", + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read redacted configuration.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "local" + ], + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [], + "requestSchema": null + }, + { + "tool": "helpdesk_config", + "operation": "get", + "requestContract": "ConfigKeyRequest", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read an allowlisted persisted configuration value.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "local" + ], + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "key": { + "type": "string", + "enum": [ + "apiBaseUrl", + "authentikScope" + ], + "minLength": 1 + } + }, + "required": [ + "key" + ], + "description": "ConfigKeyRequest for helpdesk_config operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_config", + "operation": "set", + "requestContract": "ConfigValueRequest", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "local_write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Set an allowlisted non-secret configuration value.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "unavailable_by_policy: remote configuration persistence is disabled" + }, + "credentialModes": [ + "local" + ], + "authority": "Local persisted non-secret configuration write; transport configuration surface must allow persistence", + "boundedIntegrationCredential": { + "support": "unavailable_by_policy_on_http", + "reason": "HTTP configuration surface is read-only. Local stdio persistence requires configurationWritesEnabled=true." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "unavailable_by_policy_on_http", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Local stdio only with configurationWritesEnabled=true and explicit non-secret key; HTTP remote persistence is unavailable by policy." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "key": { + "type": "string", + "enum": [ + "apiBaseUrl", + "authentikScope" + ], + "minLength": 1 + }, + "value": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "key", + "value" + ], + "description": "ConfigValueRequest for helpdesk_config operation set. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_config", + "operation": "unset", + "requestContract": "ConfigKeyRequest", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "local_write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Unset an allowlisted non-secret configuration value.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "unavailable_by_policy: remote configuration persistence is disabled" + }, + "credentialModes": [ + "local" + ], + "authority": "Local persisted non-secret configuration write; transport configuration surface must allow persistence", + "boundedIntegrationCredential": { + "support": "unavailable_by_policy_on_http", + "reason": "HTTP configuration surface is read-only. Local stdio persistence requires configurationWritesEnabled=true." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "unavailable_by_policy_on_http", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Local stdio only with configurationWritesEnabled=true and explicit non-secret key; HTTP remote persistence is unavailable by policy." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "key": { + "type": "string", + "enum": [ + "apiBaseUrl", + "authentikScope" + ], + "minLength": 1 + } + }, + "required": [ + "key" + ], + "description": "ConfigKeyRequest for helpdesk_config operation unset. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_capabilities", + "operation": "get", + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the supported catalog revision and safety policy.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "local" + ], + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [], + "requestSchema": null + }, + { + "tool": "helpdesk_system", + "operation": "version", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/system/version", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read safe system metadata.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Backend /api/v1/system/version is public metadata (AllowAnonymous); MCP ingress and the configured adapter identity still apply.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_logs", + "operation": "search", + "requestContract": "LogSearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/ai-agent/logs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Run a bounded, redacted log search.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik downstream identity satisfying exact AuthentikAiAgent scheme" + ], + "authority": "Exact AuthentikAiAgent scheme or explicit current administrator mcp-owner grant; ordinary scoped integration/gateway identities are denied regardless of scoped grants", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "Ordinary scoped credentials cannot satisfy agent-operation authority. An explicitly approved mcp-owner grant or the exact external AuthentikAiAgent scheme is required; invocation and ticket binding remain authoritative." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "since": { + "type": "integer", + "minimum": 0, + "maximum": 9223372036854775807, + "description": "Sequence cursor: return records whose numeric id is greater than since. This is not a timestamp." + }, + "correlationId": { + "type": "string", + "minLength": 1, + "pattern": "\\S", + "description": "Exact stored Activity TraceId or SpanId selector; an application X-Correlation-Id is a different identifier." + }, + "contains": { + "type": "string", + "minLength": 1, + "pattern": "\\S" + }, + "level": { + "type": "string", + "enum": [ + "Trace", + "Debug", + "Information", + "Warning", + "Error", + "Critical", + "None" + ] + }, + "limit": { + "type": "integer", + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "LogSearchRequest for helpdesk_logs operation search. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "since" + ] + }, + { + "required": [ + "correlationId" + ] + }, + { + "required": [ + "contains" + ] + } + ] + } + }, + { + "tool": "helpdesk_incidents", + "operation": "get", + "requestContract": "IncidentRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentRequest for helpdesk_incidents operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "peek", + "requestContract": "IncidentRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/peek", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "peek incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentRequest for helpdesk_incidents operation peek. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "timeline", + "requestContract": "IncidentRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentRequest for helpdesk_incidents operation timeline. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "timeline_count", + "requestContract": "IncidentCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read timeline_count for one incident.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentCountRequest for helpdesk_incidents operation timeline_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "attachments_count", + "requestContract": "IncidentCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read attachments_count for one incident.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentCountRequest for helpdesk_incidents operation attachments_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "listeners_count", + "requestContract": "IncidentCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read listeners_count for one incident.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentCountRequest for helpdesk_incidents operation listeners_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "create", + "requestContract": "IncidentCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "customerId": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "assignedToId": { + "type": [ + "string", + "null" + ] + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "impact": { + "type": [ + "string", + "null" + ] + }, + "ccRecipients": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "requesterEmail": { + "type": [ + "string", + "null" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "title", + "description", + "organizationId", + "customerId" + ], + "description": "IncidentCreateRequest for helpdesk_incidents operation create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "bulk_create", + "requestContract": "IncidentBulkCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "bulk_create incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "items": { + "type": "array", + "minItems": 1, + "maxItems": 25, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "customerId": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "assignedToId": { + "type": [ + "string", + "null" + ] + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "impact": { + "type": [ + "string", + "null" + ] + }, + "ccRecipients": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "requesterEmail": { + "type": [ + "string", + "null" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "title", + "description", + "organizationId", + "customerId" + ] + } + } + }, + "required": [ + "items" + ], + "description": "IncidentBulkCreateRequest for helpdesk_incidents operation bulk_create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "update", + "requestContract": "IncidentUpdateRequest", + "method": "PUT", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "ccRecipients": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "assignedToId": { + "type": [ + "string", + "null" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentUpdateRequest for helpdesk_incidents operation update. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "delete", + "requestContract": "IncidentRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident.Delete or Incident.Manager within the selected organization; Incident.Write alone is insufficient", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentRequest for helpdesk_incidents operation delete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "state", + "requestContract": "TicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "state incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + }, + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + } + }, + "required": [ + "incidentId", + "newState" + ], + "description": "TicketStateRequest for helpdesk_incidents operation state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "bulk_state", + "requestContract": "BulkTicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "bulk_state incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + }, + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "newState", + "ids" + ], + "description": "BulkTicketStateRequest for helpdesk_incidents operation bulk_state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "assign", + "requestContract": "TicketAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "assign incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing eligible support assignee/member for each selected organization; assign_self also needs configured agent email resolving to an eligible user." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "assignedToId": { + "type": [ + "string", + "null" + ], + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "TicketAssignmentRequest for helpdesk_incidents operation assign. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "assign_self", + "requestContract": "ConfiguredAgentAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "assign_self incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing eligible support assignee/member for each selected organization; assign_self also needs configured agent email resolving to an eligible user." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "agentUserEmail": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "ConfiguredAgentAssignmentRequest for helpdesk_incidents operation assign_self. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "add_worklog", + "requestContract": "IncidentWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/worklogs", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "add_worklog incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + }, + "hours": { + "type": "number", + "minimum": 0 + }, + "notes": { + "type": "string", + "minLength": 1 + }, + "isInternalNote": { + "type": "boolean" + } + }, + "required": [ + "incidentId", + "hours", + "notes" + ], + "description": "IncidentWorklogRequest for helpdesk_incidents operation add_worklog. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "close", + "requestContract": "IncidentCloseRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/worklogs then /state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "close incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + }, + "closureNote": { + "type": "string", + "minLength": 1 + }, + "isInternalNote": { + "type": "boolean" + } + }, + "required": [ + "incidentId", + "closureNote" + ], + "description": "IncidentCloseRequest for helpdesk_incidents operation close. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "get", + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get requests.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestRequest for helpdesk_requests operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "tasks", + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/tasks", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "tasks requests.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestRequest for helpdesk_requests operation tasks. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "timeline", + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestRequest for helpdesk_requests operation timeline. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "timeline_count", + "requestContract": "RequestCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read timeline_count for one request.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestCountRequest for helpdesk_requests operation timeline_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "attachments_count", + "requestContract": "RequestCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read attachments_count for one request.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestCountRequest for helpdesk_requests operation attachments_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "listeners_count", + "requestContract": "RequestCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read listeners_count for one request.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestCountRequest for helpdesk_requests operation listeners_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "create", + "requestContract": "RequestCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create requests.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "customerId": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "assignedToId": { + "type": [ + "string", + "null" + ] + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "category": { + "type": [ + "string", + "null" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + }, + "serviceId": { + "type": [ + "string", + "null" + ] + }, + "requestFormId": { + "type": [ + "string", + "null" + ] + }, + "payloadJson": { + "type": [ + "string", + "null" + ] + }, + "requesterEmail": { + "type": [ + "string", + "null" + ] + }, + "ccRecipients": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "description", + "title", + "organizationId", + "customerId" + ], + "description": "RequestCreateRequest for helpdesk_requests operation create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "update", + "requestContract": "RequestUpdateRequest", + "method": "PUT", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update requests.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "requestId" + ], + "description": "RequestUpdateRequest for helpdesk_requests operation update. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "delete", + "requestContract": "RequestRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete requests.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Delete or Request.Manager within the selected organization; Request.Write alone is insufficient", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestRequest for helpdesk_requests operation delete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "state", + "requestContract": "TicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/{requestId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "state requests.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + }, + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + } + }, + "required": [ + "requestId", + "newState" + ], + "description": "TicketStateRequest for helpdesk_requests operation state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "add_worklog", + "requestContract": "TicketWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/{requestId}/worklogs", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "add_worklog requests.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + }, + "hours": { + "type": "number", + "minimum": 0 + }, + "notes": { + "type": "string", + "minLength": 1 + }, + "isInternalNote": { + "type": "boolean" + } + }, + "required": [ + "requestId", + "hours", + "notes" + ], + "description": "TicketWorklogRequest for helpdesk_requests operation add_worklog. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "get", + "requestContract": "ChangeRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get changes.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeRequest for helpdesk_changes operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "timeline", + "requestContract": "ChangeRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeRequest for helpdesk_changes operation timeline. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "worklogs", + "requestContract": "ChangeRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/worklogs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "worklogs changes.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeRequest for helpdesk_changes operation worklogs. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "timeline_count", + "requestContract": "ChangeCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read timeline_count for one change.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeCountRequest for helpdesk_changes operation timeline_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "attachments_count", + "requestContract": "ChangeCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read attachments_count for one change.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeCountRequest for helpdesk_changes operation attachments_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "listeners_count", + "requestContract": "ChangeCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read listeners_count for one change.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeCountRequest for helpdesk_changes operation listeners_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "create", + "requestContract": "ChangeCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create changes.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change.Write or Change.Manager authority in selected organization; draft edit lock and lifecycle invariants apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "requestedForUserId": { + "type": "string", + "minLength": 1 + }, + "implementorUserId": { + "type": "string", + "minLength": 1 + }, + "approverUserIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "implementationStartAt": { + "type": "string", + "format": "date-time", + "minLength": 1 + }, + "implementationEndAt": { + "type": "string", + "format": "date-time", + "minLength": 1 + }, + "changeType": { + "type": "string", + "enum": [ + "Standard", + "Normal", + "Emergency" + ], + "minLength": 1 + }, + "changeTemplate": { + "type": "object", + "additionalProperties": false, + "properties": { + "isPreApproved": { + "type": [ + "boolean", + "null" + ] + }, + "existingRunbookReference": { + "type": [ + "string", + "null" + ] + }, + "scopeOfChange": { + "type": "string", + "minLength": 1 + }, + "affectedSystems": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "implementationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "validationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "rollbackReference": { + "type": [ + "string", + "null" + ] + }, + "riskClassification": { + "type": [ + "string", + "null" + ] + }, + "changeDescription": { + "type": [ + "string", + "null" + ] + }, + "businessJustification": { + "type": [ + "string", + "null" + ] + }, + "impactAssessment": { + "type": [ + "string", + "null" + ] + }, + "riskAssessment": { + "type": [ + "string", + "null" + ] + }, + "preChangeChecks": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": [ + "string", + "null" + ] + }, + "rollbackPlan": { + "type": [ + "string", + "null" + ] + }, + "dependencies": { + "type": "array", + "items": { + "type": "string" + } + }, + "emergencyReason": { + "type": [ + "string", + "null" + ] + }, + "businessImpactIfNotImplemented": { + "type": [ + "string", + "null" + ] + }, + "immediateRiskAssessment": { + "type": [ + "string", + "null" + ] + }, + "incidentReference": { + "type": [ + "string", + "null" + ] + }, + "postChangeValidation": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "scopeOfChange", + "affectedSystems", + "implementationSteps", + "validationSteps" + ], + "anyOf": [ + { + "required": [ + "rollbackPlan" + ], + "properties": { + "rollbackPlan": { + "type": "string", + "minLength": 1 + } + } + }, + { + "required": [ + "rollbackReference" + ], + "properties": { + "rollbackReference": { + "type": "string", + "minLength": 1 + } + } + } + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "title", + "description", + "changeType", + "changeTemplate", + "organizationId", + "requestedForUserId", + "implementorUserId", + "implementationStartAt", + "implementationEndAt" + ], + "description": "ChangeCreateRequest for helpdesk_changes operation create. All operation-specific fields belong inside this request object, never at the tool root.", + "allOf": [ + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Standard" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "isPreApproved", + "existingRunbookReference" + ], + "properties": { + "isPreApproved": { + "const": true + }, + "existingRunbookReference": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Normal" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "businessJustification", + "impactAssessment", + "riskAssessment", + "preChangeChecks", + "testingPlan" + ], + "properties": { + "businessJustification": { + "type": "string", + "minLength": 1 + }, + "impactAssessment": { + "type": "string", + "minLength": 1 + }, + "riskAssessment": { + "type": "string", + "minLength": 1 + }, + "preChangeChecks": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Emergency" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "emergencyReason", + "businessImpactIfNotImplemented", + "immediateRiskAssessment", + "postChangeValidation" + ], + "properties": { + "emergencyReason": { + "type": "string", + "minLength": 1 + }, + "businessImpactIfNotImplemented": { + "type": "string", + "minLength": 1 + }, + "immediateRiskAssessment": { + "type": "string", + "minLength": 1 + }, + "postChangeValidation": { + "type": "string", + "minLength": 1 + } + } + } + } + } + } + ] + } + }, + { + "tool": "helpdesk_changes", + "operation": "update", + "requestContract": "ChangeUpdateRequest", + "method": "PUT", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update changes.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change.Write or Change.Manager authority in selected organization; draft edit lock and lifecycle invariants apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "lifecycleState": { + "enum": [ + "Draft", + "Submitted", + "PendingApproval", + "ApprovedForImplementation", + "ImplementationInProgress", + "ImplementedSuccess", + "ImplementedBackedOut", + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ] + }, + "requestedForUserId": { + "type": [ + "string", + "null" + ] + }, + "implementorUserId": { + "type": [ + "string", + "null" + ] + }, + "approverUserIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "implementationStartAt": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "implementationEndAt": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + }, + "changeType": { + "type": [ + "string", + "null" + ], + "enum": [ + "Standard", + "Normal", + "Emergency" + ] + }, + "changeTemplate": { + "type": [ + "object", + "null" + ], + "additionalProperties": false, + "properties": { + "isPreApproved": { + "type": [ + "boolean", + "null" + ] + }, + "existingRunbookReference": { + "type": [ + "string", + "null" + ] + }, + "scopeOfChange": { + "type": "string", + "minLength": 1 + }, + "affectedSystems": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "implementationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "validationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "rollbackReference": { + "type": [ + "string", + "null" + ] + }, + "riskClassification": { + "type": [ + "string", + "null" + ] + }, + "changeDescription": { + "type": [ + "string", + "null" + ] + }, + "businessJustification": { + "type": [ + "string", + "null" + ] + }, + "impactAssessment": { + "type": [ + "string", + "null" + ] + }, + "riskAssessment": { + "type": [ + "string", + "null" + ] + }, + "preChangeChecks": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": [ + "string", + "null" + ] + }, + "rollbackPlan": { + "type": [ + "string", + "null" + ] + }, + "dependencies": { + "type": "array", + "items": { + "type": "string" + } + }, + "emergencyReason": { + "type": [ + "string", + "null" + ] + }, + "businessImpactIfNotImplemented": { + "type": [ + "string", + "null" + ] + }, + "immediateRiskAssessment": { + "type": [ + "string", + "null" + ] + }, + "incidentReference": { + "type": [ + "string", + "null" + ] + }, + "postChangeValidation": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "scopeOfChange", + "affectedSystems", + "implementationSteps", + "validationSteps" + ], + "anyOf": [ + { + "required": [ + "rollbackPlan" + ], + "properties": { + "rollbackPlan": { + "type": "string", + "minLength": 1 + } + } + }, + { + "required": [ + "rollbackReference" + ], + "properties": { + "rollbackReference": { + "type": "string", + "minLength": 1 + } + } + } + ] + } + }, + "required": [ + "changeId" + ], + "description": "ChangeUpdateRequest for helpdesk_changes operation update. All operation-specific fields belong inside this request object, never at the tool root.", + "allOf": [ + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Standard" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "isPreApproved", + "existingRunbookReference" + ], + "properties": { + "isPreApproved": { + "const": true + }, + "existingRunbookReference": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Normal" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "businessJustification", + "impactAssessment", + "riskAssessment", + "preChangeChecks", + "testingPlan" + ], + "properties": { + "businessJustification": { + "type": "string", + "minLength": 1 + }, + "impactAssessment": { + "type": "string", + "minLength": 1 + }, + "riskAssessment": { + "type": "string", + "minLength": 1 + }, + "preChangeChecks": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Emergency" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "emergencyReason", + "businessImpactIfNotImplemented", + "immediateRiskAssessment", + "postChangeValidation" + ], + "properties": { + "emergencyReason": { + "type": "string", + "minLength": 1 + }, + "businessImpactIfNotImplemented": { + "type": "string", + "minLength": 1 + }, + "immediateRiskAssessment": { + "type": "string", + "minLength": 1 + }, + "postChangeValidation": { + "type": "string", + "minLength": 1 + } + } + } + } + } + } + ] + } + }, + { + "tool": "helpdesk_changes", + "operation": "delete", + "requestContract": "ChangeRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete changes.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change.Delete or Change.Manager within the selected organization; Change.Write alone is insufficient", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeRequest for helpdesk_changes operation delete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "state", + "requestContract": "TicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "state changes.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change.Write or Change.Manager authority in selected organization; draft edit lock and lifecycle invariants apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + }, + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + } + }, + "required": [ + "changeId", + "newState" + ], + "description": "TicketStateRequest for helpdesk_changes operation state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "add_worklog", + "requestContract": "TicketWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/worklogs", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "add_worklog changes.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change.Write or Change.Manager authority in selected organization; draft edit lock and lifecycle invariants apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + }, + "hours": { + "type": "number", + "minimum": 0 + }, + "notes": { + "type": "string", + "minLength": 1 + }, + "isInternalNote": { + "type": "boolean" + } + }, + "required": [ + "changeId", + "hours", + "notes" + ], + "description": "TicketWorklogRequest for helpdesk_changes operation add_worklog. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "lifecycle", + "requestContract": "ChangeLifecycleRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/lifecycle", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "lifecycle changes.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "ApprovedForImplementation requires Change.Approve or Change.Manager; other transitions require Change.Write or Change.Manager, within the selected organization. API lifecycle rules apply.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + }, + "lifecycleState": { + "enum": [ + "Draft", + "Submitted", + "PendingApproval", + "ApprovedForImplementation", + "ImplementationInProgress", + "ImplementedSuccess", + "ImplementedBackedOut", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + } + }, + "required": [ + "changeId", + "lifecycleState" + ], + "description": "ChangeLifecycleRequest for helpdesk_changes operation lifecycle. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "report", + "requestContract": "AiAssistantWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/ai-assistant/investigations/{invocationId}/worklog", + "effect": "write", + "readOnly": false, + "confirmationRequired": false, + "previewSupported": false, + "description": "report operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik downstream identity satisfying exact AuthentikAiAgent scheme" + ], + "authority": "Exact AuthentikAiAgent scheme or explicit current administrator mcp-owner grant plus authenticated AI invocation reporting authority; matched invocation, ticket, event and correlation binding", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "Ordinary scoped credentials cannot satisfy agent-operation authority. An explicitly approved mcp-owner grant or the exact external AuthentikAiAgent scheme is required; invocation and ticket binding remain authoritative." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "invocationId", + "type": "uuid", + "source": "Existing authenticated AI investigation invocation bound to this ticket and correlationId" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Real authenticated existing invocation/organization/event/ticket/correlation binding under an explicitly approved owner grant or exact AI scheme, including token lifetime validation. Report appends AI worklog autonomously; a matching duplicate retains its stored event, while conflicting event-ID reuse and new callbacks after Completed, Failed or Cancelled are rejected." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "invocationId": { + "type": "string", + "format": "uuid", + "minLength": 1 + }, + "eventId": { + "type": "string", + "minLength": 1 + }, + "ticketId": { + "type": "string", + "minLength": 1 + }, + "correlationId": { + "type": "string", + "minLength": 1 + }, + "message": { + "type": "string", + "minLength": 1 + }, + "ticketType": { + "type": "string", + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1 + }, + "status": { + "type": "string", + "enum": [ + "Queued", + "Started", + "Progress", + "Finding", + "ActionAwaitingApproval", + "Completed", + "Failed", + "Cancelled" + ], + "minLength": 1 + }, + "severity": { + "type": [ + "string", + "null" + ] + }, + "metadataJson": { + "type": [ + "string", + "null" + ] + }, + "artifactReferencesJson": { + "type": [ + "string", + "null" + ] + }, + "runReference": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "invocationId", + "eventId", + "ticketId", + "correlationId", + "message", + "ticketType", + "status" + ], + "description": "AiAssistantWorklogRequest for helpdesk_ai_assistant operation report. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_forms", + "operation": "get", + "requestContract": "RequestFormRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Get one request form.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User or HelpdeskAdmin; non-administrators need an audience-eligible form in Production, or an eligible linked test user, matching OrganizationId/AllowedOrganizationIds.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestFormId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestFormId" + ], + "description": "RequestFormRequest for helpdesk_request_forms operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_forms", + "operation": "by_service", + "requestContract": "RequestFormsByServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/{serviceId}/forms/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List forms for a service.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "serviceId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "serviceId" + ], + "description": "RequestFormsByServiceRequest for helpdesk_request_forms operation by_service. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "timeline_count", + "requestContract": "TicketCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Count timeline entries.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated identity; actual ticket must pass CanViewIncident/CanViewRequest/CanViewChange: family Read, Write or Manager in its organization, or family User with matching owned customer/requester identity. Counts and mark_as_seen share this visibility check; seen-state readback is separate from notification mark_read.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1 + }, + "ticketId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "TicketCountRequest for helpdesk_tickets operation timeline_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "attachments_count", + "requestContract": "TicketCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Count attachments.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated identity; actual ticket must pass CanViewIncident/CanViewRequest/CanViewChange: family Read, Write or Manager in its organization, or family User with matching owned customer/requester identity. Counts and mark_as_seen share this visibility check; seen-state readback is separate from notification mark_read.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1 + }, + "ticketId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "TicketCountRequest for helpdesk_tickets operation attachments_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "listeners_count", + "requestContract": "TicketCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Count listeners.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated identity; actual ticket must pass CanViewIncident/CanViewRequest/CanViewChange: family Read, Write or Manager in its organization, or family User with matching owned customer/requester identity. Counts and mark_as_seen share this visibility check; seen-state readback is separate from notification mark_read.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1 + }, + "ticketId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "TicketCountRequest for helpdesk_tickets operation listeners_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 1000000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "includeTotal": { + "type": "boolean" + }, + "historicOnly": { + "type": "boolean" + }, + "activeOnly": { + "type": "boolean" + }, + "summaryOnly": { + "type": "boolean" + }, + "unassigned": { + "type": "boolean" + }, + "descending": { + "type": "boolean" + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "view": { + "type": "string", + "enum": [ + "all", + "active", + "historic" + ] + }, + "customerOrgId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "forId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "assigneeId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "stateValues": { + "oneOf": [ + { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + } + } + ] + }, + "priority": { + "oneOf": [ + { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + } + } + ] + }, + "timeField": { + "type": "string", + "enum": [ + "updated", + "created" + ] + }, + "sort": { + "type": "string", + "enum": [ + "updated", + "created", + "trackingId", + "subject", + "priority", + "state" + ] + }, + "from": { + "type": "string", + "format": "date-time" + }, + "to": { + "type": "string", + "format": "date-time" + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "excludeId": { + "type": "string", + "minLength": 1 + }, + "requesterEmail": { + "type": "string", + "minLength": 1 + } + }, + "required": [], + "description": "ListRequest for helpdesk_incidents operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 1000000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "includeTotal": { + "type": "boolean" + }, + "historicOnly": { + "type": "boolean" + }, + "activeOnly": { + "type": "boolean" + }, + "summaryOnly": { + "type": "boolean" + }, + "unassigned": { + "type": "boolean" + }, + "descending": { + "type": "boolean" + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "view": { + "type": "string", + "enum": [ + "all", + "active", + "historic" + ] + }, + "customerOrgId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "forId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "assigneeId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "stateValues": { + "oneOf": [ + { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + } + } + ] + }, + "priority": { + "oneOf": [ + { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + } + } + ] + }, + "timeField": { + "type": "string", + "enum": [ + "updated", + "created" + ] + }, + "sort": { + "type": "string", + "enum": [ + "updated", + "created", + "trackingId", + "subject", + "priority", + "state" + ] + }, + "from": { + "type": "string", + "format": "date-time" + }, + "to": { + "type": "string", + "format": "date-time" + }, + "aiOnly": { + "type": "boolean" + } + }, + "required": [], + "description": "ListRequest for helpdesk_requests operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "bulk_create", + "requestContract": "RequestBulkCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "bulk_create operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "items": { + "type": "array", + "minItems": 1, + "maxItems": 25, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "customerId": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "assignedToId": { + "type": [ + "string", + "null" + ] + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "category": { + "type": [ + "string", + "null" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + }, + "serviceId": { + "type": [ + "string", + "null" + ] + }, + "requestFormId": { + "type": [ + "string", + "null" + ] + }, + "payloadJson": { + "type": [ + "string", + "null" + ] + }, + "requesterEmail": { + "type": [ + "string", + "null" + ] + }, + "ccRecipients": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "description", + "title", + "organizationId", + "customerId" + ] + } + } + }, + "required": [ + "items" + ], + "description": "RequestBulkCreateRequest for helpdesk_requests operation bulk_create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "bulk_state", + "requestContract": "BulkTicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/bulk/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "bulk_state operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + }, + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "newState", + "ids" + ], + "description": "BulkTicketStateRequest for helpdesk_requests operation bulk_state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "assign", + "requestContract": "TicketAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "assign operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing eligible support assignee/member for each selected organization; assign_self also needs configured agent email resolving to an eligible user." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "assignedToId": { + "type": [ + "string", + "null" + ], + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "TicketAssignmentRequest for helpdesk_requests operation assign. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_requests", + "operation": "assign_self", + "requestContract": "ConfiguredAgentAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "assign_self operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing eligible support assignee/member for each selected organization; assign_self also needs configured agent email resolving to an eligible user." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "agentUserEmail": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "ConfiguredAgentAssignmentRequest for helpdesk_requests operation assign_self. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 1000000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "includeTotal": { + "type": "boolean" + }, + "historicOnly": { + "type": "boolean" + }, + "activeOnly": { + "type": "boolean" + }, + "summaryOnly": { + "type": "boolean" + }, + "unassigned": { + "type": "boolean" + }, + "descending": { + "type": "boolean" + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "view": { + "type": "string", + "enum": [ + "all", + "active", + "historic" + ] + }, + "customerOrgId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "forId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "assigneeId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "stateValues": { + "oneOf": [ + { + "enum": [ + "Draft", + "Submitted", + "PendingApproval", + "ApprovedForImplementation", + "ImplementationInProgress", + "ImplementedSuccess", + "ImplementedBackedOut", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "Draft", + "Submitted", + "PendingApproval", + "ApprovedForImplementation", + "ImplementationInProgress", + "ImplementedSuccess", + "ImplementedBackedOut", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + } + } + ] + }, + "priority": { + "oneOf": [ + { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + } + } + ] + }, + "timeField": { + "type": "string", + "enum": [ + "updated", + "created" + ] + }, + "sort": { + "type": "string", + "enum": [ + "updated", + "created", + "trackingId", + "subject", + "priority", + "state" + ] + }, + "from": { + "type": "string", + "format": "date-time" + }, + "to": { + "type": "string", + "format": "date-time" + }, + "lifecycleState": { + "enum": [ + "Draft", + "Submitted", + "PendingApproval", + "ApprovedForImplementation", + "ImplementationInProgress", + "ImplementedSuccess", + "ImplementedBackedOut", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + } + }, + "required": [], + "description": "ListRequest for helpdesk_changes operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "bulk_create", + "requestContract": "ChangeBulkCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "bulk_create operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Change.Write or Change.Manager authority in selected organization; draft edit lock and lifecycle invariants apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "items": { + "type": "array", + "minItems": 1, + "maxItems": 25, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "requestedForUserId": { + "type": "string", + "minLength": 1 + }, + "implementorUserId": { + "type": "string", + "minLength": 1 + }, + "approverUserIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "implementationStartAt": { + "type": "string", + "format": "date-time", + "minLength": 1 + }, + "implementationEndAt": { + "type": "string", + "format": "date-time", + "minLength": 1 + }, + "changeType": { + "type": "string", + "enum": [ + "Standard", + "Normal", + "Emergency" + ], + "minLength": 1 + }, + "changeTemplate": { + "type": "object", + "additionalProperties": false, + "properties": { + "isPreApproved": { + "type": [ + "boolean", + "null" + ] + }, + "existingRunbookReference": { + "type": [ + "string", + "null" + ] + }, + "scopeOfChange": { + "type": "string", + "minLength": 1 + }, + "affectedSystems": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "implementationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "validationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "rollbackReference": { + "type": [ + "string", + "null" + ] + }, + "riskClassification": { + "type": [ + "string", + "null" + ] + }, + "changeDescription": { + "type": [ + "string", + "null" + ] + }, + "businessJustification": { + "type": [ + "string", + "null" + ] + }, + "impactAssessment": { + "type": [ + "string", + "null" + ] + }, + "riskAssessment": { + "type": [ + "string", + "null" + ] + }, + "preChangeChecks": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": [ + "string", + "null" + ] + }, + "rollbackPlan": { + "type": [ + "string", + "null" + ] + }, + "dependencies": { + "type": "array", + "items": { + "type": "string" + } + }, + "emergencyReason": { + "type": [ + "string", + "null" + ] + }, + "businessImpactIfNotImplemented": { + "type": [ + "string", + "null" + ] + }, + "immediateRiskAssessment": { + "type": [ + "string", + "null" + ] + }, + "incidentReference": { + "type": [ + "string", + "null" + ] + }, + "postChangeValidation": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "scopeOfChange", + "affectedSystems", + "implementationSteps", + "validationSteps" + ], + "anyOf": [ + { + "required": [ + "rollbackPlan" + ], + "properties": { + "rollbackPlan": { + "type": "string", + "minLength": 1 + } + } + }, + { + "required": [ + "rollbackReference" + ], + "properties": { + "rollbackReference": { + "type": "string", + "minLength": 1 + } + } + } + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "title", + "description", + "changeType", + "changeTemplate", + "organizationId", + "requestedForUserId", + "implementorUserId", + "implementationStartAt", + "implementationEndAt" + ], + "allOf": [ + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Standard" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "isPreApproved", + "existingRunbookReference" + ], + "properties": { + "isPreApproved": { + "const": true + }, + "existingRunbookReference": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Normal" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "businessJustification", + "impactAssessment", + "riskAssessment", + "preChangeChecks", + "testingPlan" + ], + "properties": { + "businessJustification": { + "type": "string", + "minLength": 1 + }, + "impactAssessment": { + "type": "string", + "minLength": 1 + }, + "riskAssessment": { + "type": "string", + "minLength": 1 + }, + "preChangeChecks": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Emergency" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "emergencyReason", + "businessImpactIfNotImplemented", + "immediateRiskAssessment", + "postChangeValidation" + ], + "properties": { + "emergencyReason": { + "type": "string", + "minLength": 1 + }, + "businessImpactIfNotImplemented": { + "type": "string", + "minLength": 1 + }, + "immediateRiskAssessment": { + "type": "string", + "minLength": 1 + }, + "postChangeValidation": { + "type": "string", + "minLength": 1 + } + } + } + } + } + } + ] + } + } + }, + "required": [ + "items" + ], + "description": "ChangeBulkCreateRequest for helpdesk_changes operation bulk_create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "bulk_state", + "requestContract": "BulkTicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/bulk/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "bulk_state operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + }, + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "newState", + "ids" + ], + "description": "BulkTicketStateRequest for helpdesk_changes operation bulk_state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "assign", + "requestContract": "TicketAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "assign operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing eligible support assignee/member for each selected organization; assign_self also needs configured agent email resolving to an eligible user.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "assignedToId": { + "type": [ + "string", + "null" + ], + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "TicketAssignmentRequest for helpdesk_changes operation assign. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_changes", + "operation": "assign_self", + "requestContract": "ConfiguredAgentAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "assign_self operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing eligible support assignee/member for each selected organization; assign_self also needs configured agent email resolving to an eligible user.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "agentUserEmail": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "ConfiguredAgentAssignmentRequest for helpdesk_changes operation assign_self. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-tasks/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Read, Request.Write or Request.Manager on the parent organization; owned-request permission alone does not grant task administration", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 1000000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "includeTotal": { + "type": "boolean" + }, + "historicOnly": { + "type": "boolean" + }, + "assignedToId": { + "type": "string", + "minLength": 1 + }, + "requestId": { + "type": "string", + "minLength": 1 + }, + "serviceId": { + "type": "string", + "minLength": 1 + }, + "assignedToMe": { + "type": "boolean" + }, + "status": { + "enum": [ + "Pending", + "InProgress", + "Completed", + "Failed", + "Skipped", + "PendingApproval", + "Cancelled", + 1, + 2, + 3, + 4, + 5, + 6, + 7 + ] + }, + "type": { + "enum": [ + "Manual", + "Automation", + "Approval", + 1, + 2, + 3 + ] + } + }, + "required": [], + "description": "ListRequest for helpdesk_request_tasks operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "get", + "requestContract": "RequestTaskRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-tasks/{taskId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Read, Request.Write or Request.Manager on the parent organization; owned-request permission alone does not grant task administration", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "taskId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "create", + "requestContract": "RequestTaskCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Write or Request.Manager on parent/task organization; immutable parent/customer/organization identity", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "requestId": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "customerId": { + "type": [ + "string", + "null" + ], + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "linkedAssetIds": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "attachments": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "dueDate": { + "type": "string", + "format": "date-time" + } + }, + "required": [ + "title", + "description", + "requestId", + "organizationId" + ], + "description": "RequestTaskCreateRequest for helpdesk_request_tasks operation create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "update", + "requestContract": "RequestTaskUpdateRequest", + "method": "PATCH", + "pathTemplate": "/api/v1/request-tasks/{taskId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Write or Request.Manager on parent/task organization; immutable parent/customer/organization identity", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "taskId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + }, + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "assignedToId": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "linkedAssetIds": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "attachments": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "dueDate": { + "type": "string", + "format": "date-time" + }, + "clearAssignment": { + "type": "boolean" + }, + "clearDueDate": { + "type": "boolean" + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskUpdateRequest for helpdesk_request_tasks operation update. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "title" + ], + "properties": {} + }, + { + "required": [ + "description" + ], + "properties": {} + }, + { + "required": [ + "priority" + ], + "properties": {} + }, + { + "required": [ + "assignedToId" + ], + "properties": {} + }, + { + "required": [ + "linkedAssetIds" + ], + "properties": {} + }, + { + "required": [ + "attachments" + ], + "properties": {} + }, + { + "required": [ + "dueDate" + ], + "properties": {} + }, + { + "required": [ + "clearAssignment" + ], + "properties": { + "clearAssignment": { + "const": true + } + } + }, + { + "required": [ + "clearDueDate" + ], + "properties": { + "clearDueDate": { + "const": true + } + } + } + ], + "allOf": [ + { + "not": { + "required": [ + "clearAssignment", + "assignedToId" + ], + "properties": { + "clearAssignment": { + "const": true + } + } + } + }, + { + "not": { + "required": [ + "clearDueDate", + "dueDate" + ], + "properties": { + "clearDueDate": { + "const": true + } + } + } + } + ] + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "delete", + "requestContract": "RequestTaskRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/request-tasks/{taskId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Write or Request.Manager on parent/task organization; immutable parent/customer/organization identity", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "taskId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation delete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "start", + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/start", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "start operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "taskId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation start. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "complete", + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/complete", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "complete operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "taskId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation complete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "fail", + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/fail", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "fail operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "taskId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation fail. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "retry", + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/retry", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "retry operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "taskId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Eligible failed automation task with configured orchestration peer, tenant and binding. Manual-task retry is unsupported. updated=0 means no eligible transition, never proof of mutation." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation retry. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "bulk_start", + "requestContract": "BulkRequestTaskActionRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/bulk/start", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "bulk_start operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "ids" + ], + "description": "BulkRequestTaskActionRequest for helpdesk_request_tasks operation bulk_start. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "bulk_complete", + "requestContract": "BulkRequestTaskActionRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/bulk/complete", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "bulk_complete operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "ids" + ], + "description": "BulkRequestTaskActionRequest for helpdesk_request_tasks operation bulk_complete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "bulk_retry", + "requestContract": "BulkRequestTaskActionRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/bulk/retry", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "bulk_retry operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Eligible failed automation task with configured orchestration peer, tenant and binding. Manual-task retry is unsupported. updated=0 means no eligible transition, never proof of mutation." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "ids" + ], + "description": "BulkRequestTaskActionRequest for helpdesk_request_tasks operation bulk_retry. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_organizations", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/organizations/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "list operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [], + "description": "ListRequest for helpdesk_organizations operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_organizations", + "operation": "get", + "requestContract": "OrganizationRequest", + "method": "GET", + "pathTemplate": "/api/v1/organizations/{organizationId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "organizationId" + ], + "description": "OrganizationRequest for helpdesk_organizations operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_organizations", + "operation": "tenants", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/tenants", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "tenants operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_organizations", + "operation": "tenant_lookup", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/tenants/lookup", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "tenant_lookup operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_organizations", + "operation": "change_participants", + "requestContract": "OrganizationRequest", + "method": "GET", + "pathTemplate": "/api/v1/organizations/{organizationId}/change-participants", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "change_participants operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "organizationId" + ], + "description": "OrganizationRequest for helpdesk_organizations operation change_participants. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_customers", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/customers/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "list operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [], + "description": "ListRequest for helpdesk_customers operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_customers", + "operation": "get", + "requestContract": "CustomerRequest", + "method": "GET", + "pathTemplate": "/api/v1/customers/{customerId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "customerId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "CustomerRequest for helpdesk_customers operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_users", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/users/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "list operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [], + "description": "ListRequest for helpdesk_users operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_users", + "operation": "get", + "requestContract": "UserRequest", + "method": "GET", + "pathTemplate": "/api/v1/users/{userId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "userId" + ], + "description": "UserRequest for helpdesk_users operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_roles", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/role-definitions/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "list operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "HelpdeskAdmin or scoped role-management authority for ownerOrganizationId; only delegable permission intersection", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [], + "description": "ListRequest for helpdesk_roles operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_roles", + "operation": "get", + "requestContract": "RoleRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/role-definitions/{roleId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "HelpdeskAdmin or scoped role-management authority for ownerOrganizationId; only delegable permission intersection", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "roleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "roleId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "roleId" + ], + "description": "RoleRequest for helpdesk_roles operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_categories", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/categories/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "list operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "TicketReadAccess: an Incident/Request/Change Read, Write, User or Manager grant, SelfService.User, or HelpdeskAdmin. Results are scoped to system/current tenant categories; allScopes=true or includeInactive=true additionally requires HelpdeskAdmin.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "enum": [ + "Service", + "Incident", + "Request", + "Change", + 0, + 1, + 2, + 3 + ] + }, + "search": { + "type": "string", + "maxLength": 120 + }, + "ids": { + "type": "string", + "minLength": 1 + }, + "take": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "allScopes": { + "type": "boolean" + }, + "includeInactive": { + "type": "boolean" + } + }, + "required": [], + "description": "ListRequest for helpdesk_categories operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_customers", + "operation": "auth_status", + "requestContract": "CustomerRequest", + "method": "GET", + "pathTemplate": "/api/v1/customers/{customerId}/auth/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "auth_status operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "customerId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing customer and HelpdeskAdmin; inspect Local/External identity-provider mode and the account linkage before selecting an activation, invitation, enable/disable or synchronization operation." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "CustomerRequest for helpdesk_customers operation auth_status. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_users", + "operation": "by_email", + "requestContract": "UserEmailRequest", + "method": "GET", + "pathTemplate": "/api/v1/users/by-email/{email}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "by_email operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "email", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "email": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "email" + ], + "description": "UserEmailRequest for helpdesk_users operation by_email. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_search", + "operation": "users", + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/global-search/users", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "users operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": "string", + "minLength": 1 + }, + "q": { + "type": "string", + "minLength": 1 + }, + "limit": { + "type": "integer", + "minimum": 1, + "maximum": 25, + "description": "Alias of pageSize; bounded result count, maximum25. TotalCount describes returned bounded rows, not full filtered dataset." + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 25 + } + }, + "required": [], + "description": "SearchRequest for helpdesk_search operation users. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "query" + ] + }, + { + "required": [ + "q" + ] + } + ] + } + }, + { + "tool": "helpdesk_search", + "operation": "customers", + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/global-search/customers", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "customers operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": "string", + "minLength": 1 + }, + "q": { + "type": "string", + "minLength": 1 + }, + "limit": { + "type": "integer", + "minimum": 1, + "maximum": 25, + "description": "Alias of pageSize; bounded result count, maximum25. TotalCount describes returned bounded rows, not full filtered dataset." + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 25 + } + }, + "required": [], + "description": "SearchRequest for helpdesk_search operation customers. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "query" + ] + }, + { + "required": [ + "q" + ] + } + ] + } + }, + { + "tool": "helpdesk_search", + "operation": "organizations", + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/global-search/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "organizations operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": "string", + "minLength": 1 + }, + "q": { + "type": "string", + "minLength": 1 + }, + "limit": { + "type": "integer", + "minimum": 1, + "maximum": 25, + "description": "Alias of pageSize; bounded result count, maximum25. TotalCount describes returned bounded rows, not full filtered dataset." + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 25 + } + }, + "required": [], + "description": "SearchRequest for helpdesk_search operation organizations. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "query" + ] + }, + { + "required": [ + "q" + ] + } + ] + } + }, + { + "tool": "helpdesk_tickets", + "operation": "mark_as_seen", + "requestContract": "TicketSeenRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/mark-as-seen", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "mark_as_seen operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated identity; actual ticket must pass CanViewIncident/CanViewRequest/CanViewChange: family Read, Write or Manager in its organization, or family User with matching owned customer/requester identity. Counts and mark_as_seen share this visibility check; seen-state readback is separate from notification mark_read.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing visible ticket. Verify seen state independently after acceptance; notification mark_read is a separate operation." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ticketId" + ], + "description": "TicketSeenRequest for helpdesk_tickets operation mark_as_seen. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_services", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "list operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [], + "description": "ListRequest for helpdesk_services operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_services", + "operation": "get", + "requestContract": "ServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/{serviceId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User or HelpdeskAdmin. Non-administrators need current tenant identity and service AllowedOrganizationIds/AllowedCustomerIds visibility; items/search_items also filter forms by release/test-user and organization audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "serviceId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "serviceId" + ], + "description": "ServiceRequest for helpdesk_services operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_services", + "operation": "items", + "requestContract": "ServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/service-items/{serviceId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "items operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User or HelpdeskAdmin. Non-administrators need current tenant identity and service AllowedOrganizationIds/AllowedCustomerIds visibility; items/search_items also filter forms by release/test-user and organization audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "serviceId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "serviceId" + ], + "description": "ServiceRequest for helpdesk_services operation items. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_services", + "operation": "search_items", + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/service-items/search", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "search_items operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User or HelpdeskAdmin. Non-administrators need current tenant identity and service AllowedOrganizationIds/AllowedCustomerIds visibility; items/search_items also filter forms by release/test-user and organization audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": "string", + "minLength": 1 + }, + "q": { + "type": "string", + "minLength": 1 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 25 + }, + "includeTotal": { + "type": "boolean" + } + }, + "required": [], + "description": "SearchRequest for helpdesk_services operation search_items. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "query" + ] + }, + { + "required": [ + "q" + ] + } + ] + } + }, + { + "tool": "helpdesk_services", + "operation": "breadcrumb", + "requestContract": "ServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/{serviceId}/breadcrumb", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "breadcrumb operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User or HelpdeskAdmin. Non-administrators need current tenant identity and service AllowedOrganizationIds/AllowedCustomerIds visibility; items/search_items also filter forms by release/test-user and organization audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "serviceId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "serviceId" + ], + "description": "ServiceRequest for helpdesk_services operation breadcrumb. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_self_service", + "operation": "requests", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/requests", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "requests operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User or HelpdeskAdmin; non-administrators need an enabled linked customer and organization scope, owned request visibility and any applicable request-form audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "For non-administrators, an enabled linked customer in an authorized organization and owned request; any referenced form must remain audience-eligible." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "q": { + "type": "string" + } + }, + "required": [], + "description": "ListRequest for helpdesk_self_service operation requests. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_self_service", + "operation": "request_users", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/request-users", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "request_users operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User or HelpdeskAdmin; search users/customer contacts in the caller\u0027s visible organizations. A linked customer identity is not required for this lookup.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "SelfService.User or HelpdeskAdmin and visible organization scope; this lookup supports authorized requested-for selection without requiring the caller\u0027s own linked customer." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "query": { + "type": "string" + } + }, + "required": [], + "description": "ListRequest for helpdesk_self_service operation request_users. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_self_service", + "operation": "get_request", + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/requests/{requestId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get_request operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User or HelpdeskAdmin; non-administrators need an enabled linked customer and organization scope, owned request visibility and any applicable request-form audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "For non-administrators, an enabled linked customer in an authorized organization and owned request; any referenced form must remain audience-eligible." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestRequest for helpdesk_self_service operation get_request. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "list", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "list operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated NotificationAccess plus resolved application user ID. Personal referenced-ticket notices require current ticket ownership/module scope; broadcasts require matching tenant module scope (unclassified notices require all module scopes). HelpdeskAdmin sees all. summary/unread_errors use the same visible set; unread_errors adds unread Error/Critical filtering.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "search": { + "type": "string" + }, + "source": { + "type": "string" + }, + "category": { + "type": "string" + }, + "sortBy": { + "type": "string" + }, + "sortDir": { + "type": "string" + }, + "severity": { + "enum": [ + "Info", + "Warning", + "Error", + "Success", + "Critical", + 0, + 1, + 2, + 3, + 4 + ] + }, + "from": { + "type": "string", + "format": "date-time" + }, + "to": { + "type": "string", + "format": "date-time" + } + }, + "required": [], + "description": "ListRequest for helpdesk_notifications operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "get", + "requestContract": "NotificationRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/{notificationId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated NotificationAccess plus resolved application user ID. Personal referenced-ticket notices require current ticket ownership/module scope; broadcasts require matching tenant module scope (unclassified notices require all module scopes). HelpdeskAdmin sees all. summary/unread_errors use the same visible set; unread_errors adds unread Error/Critical filtering.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "notificationId", + "type": "uuid", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "notificationId": { + "type": "string", + "format": "uuid", + "minLength": 1 + } + }, + "required": [ + "notificationId" + ], + "description": "NotificationRequest for helpdesk_notifications operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "summary", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/notifications/summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read total, unread and unread Error/Critical counts for the actor\u0027s complete authorized notification population.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated NotificationAccess plus resolved application user ID. Personal referenced-ticket notices require current ticket ownership/module scope; broadcasts require matching tenant module scope (unclassified notices require all module scopes). HelpdeskAdmin sees all. summary/unread_errors use the same visible set; unread_errors adds unread Error/Critical filtering.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_notifications", + "operation": "unread_errors", + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/unread-errors", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "unread_errors operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated NotificationAccess plus resolved application user ID. Personal referenced-ticket notices require current ticket ownership/module scope; broadcasts require matching tenant module scope (unclassified notices require all module scopes). HelpdeskAdmin sees all. summary/unread_errors use the same visible set; unread_errors adds unread Error/Critical filtering.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "take": { + "type": "integer", + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "ListRequest for helpdesk_notifications operation unread_errors. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "mark_read", + "requestContract": "NotificationMarkReadRequest", + "method": "POST", + "pathTemplate": "/api/v1/notifications/mark-read", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "mark_read operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated NotificationAccess plus resolved application user ID. Only currently visible notification IDs may be marked; personal notices must belong to that user, global reads create that user\u0027s own marker. updated=0 is a no-op.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "ids" + ], + "description": "NotificationMarkReadRequest for helpdesk_notifications operation mark_read. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration", + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "orchestration operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Configured enabled external orchestration peer, permitted network connection and a unique/selected saved automation connection. Settings/catalog/test accept optional organizationId and connectionId to select an eligible saved mapping; binding inventory has its existing contract. Multiple unresolved connections return connection_selection_required (409); missing configuration is a prerequisite failure, not a successful probe. Test uses this integration\u0027s own connectivity service and causes outbound traffic, with zero job ingestion." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "pattern": "\\S", + "description": "Optional exact local organization with a saved eligible automation mapping. Omit for the existing unique-connection resolver." + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "description": "Optional non-empty saved SystemConnection ID. The API enforces its mapping, capability and organization; this is not an authority grant." + } + }, + "required": [], + "description": "OrchestrationSelectionRequest for helpdesk_connectivity operation orchestration. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration_jobs", + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/catalog/jobs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "orchestration_jobs operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Configured enabled external orchestration peer, permitted network connection and a unique/selected saved automation connection. Settings/catalog/test accept optional organizationId and connectionId to select an eligible saved mapping; binding inventory has its existing contract. Multiple unresolved connections return connection_selection_required (409); missing configuration is a prerequisite failure, not a successful probe. Test uses this integration\u0027s own connectivity service and causes outbound traffic, with zero job ingestion." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "pattern": "\\S", + "description": "Optional exact local organization with a saved eligible automation mapping. Omit for the existing unique-connection resolver." + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "description": "Optional non-empty saved SystemConnection ID. The API enforces its mapping, capability and organization; this is not an authority grant." + } + }, + "required": [], + "description": "OrchestrationSelectionRequest for helpdesk_connectivity operation orchestration_jobs. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration_tenants", + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/catalog/tenants", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "orchestration_tenants operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Configured enabled external orchestration peer, permitted network connection and a unique/selected saved automation connection. Settings/catalog/test accept optional organizationId and connectionId to select an eligible saved mapping; binding inventory has its existing contract. Multiple unresolved connections return connection_selection_required (409); missing configuration is a prerequisite failure, not a successful probe. Test uses this integration\u0027s own connectivity service and causes outbound traffic, with zero job ingestion." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "pattern": "\\S", + "description": "Optional exact local organization with a saved eligible automation mapping. Omit for the existing unique-connection resolver." + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "description": "Optional non-empty saved SystemConnection ID. The API enforces its mapping, capability and organization; this is not an authority grant." + } + }, + "required": [], + "description": "OrchestrationSelectionRequest for helpdesk_connectivity operation orchestration_tenants. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration_request_definitions", + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/catalog/request-definitions", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "orchestration_request_definitions operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Configured enabled external orchestration peer, permitted network connection and a unique/selected saved automation connection. Settings/catalog/test accept optional organizationId and connectionId to select an eligible saved mapping; binding inventory has its existing contract. Multiple unresolved connections return connection_selection_required (409); missing configuration is a prerequisite failure, not a successful probe. Test uses this integration\u0027s own connectivity service and causes outbound traffic, with zero job ingestion." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "pattern": "\\S", + "description": "Optional exact local organization with a saved eligible automation mapping. Omit for the existing unique-connection resolver." + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "description": "Optional non-empty saved SystemConnection ID. The API enforces its mapping, capability and organization; this is not an authority grant." + } + }, + "required": [], + "description": "OrchestrationSelectionRequest for helpdesk_connectivity operation orchestration_request_definitions. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration_bindings", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "orchestration_bindings operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Configured enabled external orchestration peer, permitted network connection and a unique/selected saved automation connection. Settings/catalog/test accept optional organizationId and connectionId to select an eligible saved mapping; binding inventory has its existing contract. Multiple unresolved connections return connection_selection_required (409); missing configuration is a prerequisite failure, not a successful probe. Test uses this integration\u0027s own connectivity service and causes outbound traffic, with zero job ingestion." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration_test", + "requestContract": "OrchestrationSelectionRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "orchestration_test operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Configured enabled external orchestration peer, permitted network connection and a unique/selected saved automation connection. Settings/catalog/test accept optional organizationId and connectionId to select an eligible saved mapping; binding inventory has its existing contract. Multiple unresolved connections return connection_selection_required (409); missing configuration is a prerequisite failure, not a successful probe. Test uses this integration\u0027s own connectivity service and causes outbound traffic, with zero job ingestion." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "pattern": "\\S", + "description": "Optional exact local organization with a saved eligible automation mapping. Omit for the existing unique-connection resolver." + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "description": "Optional non-empty saved SystemConnection ID. The API enforces its mapping, capability and organization; this is not an authority grant." + } + }, + "required": [], + "description": "OrchestrationSelectionRequest for helpdesk_connectivity operation orchestration_test. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_schema", + "operation": "list", + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the executable MCP operation catalog.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "local" + ], + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [], + "requestSchema": null + }, + { + "tool": "helpdesk_enums", + "operation": "list", + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read enum metadata.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "local" + ], + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [], + "requestSchema": null + }, + { + "tool": "helpdesk_enums", + "operation": "ticket_state", + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read enum metadata.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "local" + ], + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [], + "requestSchema": null + }, + { + "tool": "helpdesk_enums", + "operation": "ticket_priority", + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read enum metadata.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "local" + ], + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [], + "requestSchema": null + }, + { + "tool": "helpdesk_enums", + "operation": "request_task_status", + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read enum metadata.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "local" + ], + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [], + "requestSchema": null + }, + { + "tool": "helpdesk_enums", + "operation": "change_lifecycle_state", + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read enum metadata.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "local" + ], + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [], + "requestSchema": null + }, + { + "tool": "helpdesk_examples", + "operation": "list", + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read operator examples.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "local" + ], + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [], + "requestSchema": null + }, + { + "tool": "helpdesk_raw", + "operation": "system_version", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/system/version", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "system_version operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Fixed GET of public backend system-version metadata; configured MCP ingress/adapter identity still applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Fixed named allowlisted GET only. Arbitrary raw methods, paths, hosts and unknown operations are unsupported; rawEnabled=false describes arbitrary access." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_raw", + "operation": "get_incident", + "requestContract": "AllowlistedReadRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get_incident operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Fixed incident GET: Incident.Read, Incident.Write or Incident.Manager in organization, or Incident.User with matching customer/requester ownership", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Fixed named allowlisted GET only. Arbitrary raw methods, paths, hosts and unknown operations are unsupported; rawEnabled=false describes arbitrary access." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "AllowlistedReadRequest for helpdesk_raw operation get_incident. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_raw", + "operation": "get_request", + "requestContract": "AllowlistedReadRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get_request operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Fixed request GET: Request.Read, Request.Write or Request.Manager in organization, or Request.User with matching customer/requester ownership", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Fixed named allowlisted GET only. Arbitrary raw methods, paths, hosts and unknown operations are unsupported; rawEnabled=false describes arbitrary access." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "AllowlistedReadRequest for helpdesk_raw operation get_request. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_raw", + "operation": "get_change", + "requestContract": "AllowlistedReadRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "get_change operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Fixed change GET: Change.Read, Change.Write or Change.Manager in organization, or Change.User with matching customer/requester ownership", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Fixed named allowlisted GET only. Arbitrary raw methods, paths, hosts and unknown operations are unsupported; rawEnabled=false describes arbitrary access." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "AllowlistedReadRequest for helpdesk_raw operation get_change. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_organization", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/organizations", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create_organization operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string", + "minLength": 1 + }, + "dnsName": { + "type": [ + "string", + "null" + ] + }, + "contactInfo": { + "type": [ + "string", + "null" + ] + }, + "assignedSlaId": { + "type": [ + "string", + "null" + ] + }, + "itSupportOrganizationId": { + "type": [ + "string", + "null" + ] + }, + "orchestrationTenantId": { + "type": [ + "integer", + "null" + ] + }, + "orchestrationTenantName": { + "type": [ + "string", + "null" + ] + }, + "state": { + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_organization. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_organization", + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/organizations/{organizationId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update_organization operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "dnsName": { + "type": [ + "string", + "null" + ] + }, + "contactInfo": { + "type": [ + "string", + "null" + ] + }, + "assignedSlaId": { + "type": [ + "string", + "null" + ] + }, + "itSupportOrganizationId": { + "type": [ + "string", + "null" + ] + }, + "orchestrationTenantId": { + "type": [ + "integer", + "null" + ] + }, + "orchestrationTenantName": { + "type": [ + "string", + "null" + ] + }, + "state": { + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "organizationId", + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_organization. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_organization", + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/organizations/{organizationId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete_organization operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "organizationId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_organization. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_customer", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create_customer operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string", + "minLength": 1 + }, + "email": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "state": { + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "name", + "email", + "organizationId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_customer. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_customer", + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/customers/{customerId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update_customer operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "customerId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "email": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "state": { + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "customerId", + "name", + "email", + "organizationId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_customer. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_customer", + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/customers/{customerId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete_customer operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "customerId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_customer. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_user", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/users", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create_user operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1 + }, + "email": { + "type": "string", + "minLength": 1 + }, + "role": { + "type": "string", + "minLength": 1 + }, + "isTestUser": { + "type": "boolean" + }, + "organizationId": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "name", + "email", + "role" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_user. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_user", + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/users/{userId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update_user operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "email": { + "type": "string", + "minLength": 1 + }, + "role": { + "type": "string", + "minLength": 1 + }, + "isTestUser": { + "type": "boolean" + }, + "organizationId": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "userId", + "name", + "email", + "role" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_user. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_user", + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/users/{userId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete_user operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "userId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_user. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_category", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/categories", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create_category operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "type": { + "enum": [ + 0, + 1, + 2, + 3 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "format": "uuid" + }, + "parentCategoryId": { + "type": [ + "string", + "null" + ], + "format": "uuid" + }, + "sortOrder": { + "type": "integer" + }, + "isActive": { + "type": "boolean" + } + }, + "required": [ + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_category. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_category", + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/categories/{categoryId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update_category operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "categoryId", + "type": "uuid", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "categoryId": { + "type": "string", + "format": "uuid", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "type": { + "enum": [ + 0, + 1, + 2, + 3 + ] + }, + "parentCategoryId": { + "type": [ + "string", + "null" + ], + "format": "uuid" + }, + "sortOrder": { + "type": "integer" + }, + "isActive": { + "type": "boolean" + } + }, + "required": [ + "categoryId", + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_category. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_category", + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/categories/{categoryId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete_category operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "categoryId", + "type": "uuid", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "categoryId": { + "type": "string", + "format": "uuid", + "minLength": 1 + } + }, + "required": [ + "categoryId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_category. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_service", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/services", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create_service operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string" + }, + "parentId": { + "type": [ + "string", + "null" + ] + }, + "allowedCustomerIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "allowedOrganizationIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_service. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_service", + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/services/{serviceId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update_service operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "serviceId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string" + }, + "parentId": { + "type": [ + "string", + "null" + ] + }, + "allowedCustomerIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "allowedOrganizationIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "serviceId", + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_service. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_service", + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/services/{serviceId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete_service operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "serviceId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "serviceId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_service. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_role", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/role-definitions", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create_role operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "HelpdeskAdmin or scoped role-management authority for ownerOrganizationId; only delegable permission intersection", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "A custom role needs a name and at least one supported permission; creation also requires an enabled ownerOrganizationId. Write/delete/execute/approve permissions include corresponding Read; legacy Manager permissions include corresponding User. Delegation remains bounded by caller authority." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1 + }, + "permissions": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "type": "string", + "enum": [ + "SelfService.User", + "Incident.User", + "Incident.Manager", + "Incident.Read", + "Incident.Write", + "Incident.Delete", + "Request.User", + "Request.Manager", + "Request.Read", + "Request.Write", + "Request.Delete", + "Request.Execute", + "Change.User", + "Change.Manager", + "Change.Read", + "Change.Write", + "Change.Delete", + "Change.Approve", + "DataManagement.Admin", + "Tenant.Users.Manage", + "Tenant.Roles.Assign", + "Tenant.Settings.Manage", + "Tenant.Customers.Manage", + "Tenant.Sla.Manage" + ] + } + }, + "key": { + "type": [ + "string", + "null" + ], + "description": "Optional custom. key using letters, numbers, periods or hyphens, at most 128 characters after trimming; omitted/blank generates a key from name." + }, + "ownerOrganizationId": { + "type": "string", + "minLength": 1, + "pattern": "\\S", + "description": "Required enabled owner organization; scoped role authority and delegable permission intersection apply." + } + }, + "required": [ + "name", + "permissions", + "ownerOrganizationId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_role. All operation-specific fields belong inside this request object, never at the tool root.", + "allOf": [ + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Execute" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Approve" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + } + ] + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_role", + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/role-definitions/{roleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update_role operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "HelpdeskAdmin or scoped role-management authority for ownerOrganizationId; only delegable permission intersection", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "roleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "A custom role needs a name and at least one supported permission; creation also requires an enabled ownerOrganizationId. Write/delete/execute/approve permissions include corresponding Read; legacy Manager permissions include corresponding User. Delegation remains bounded by caller authority." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "roleId": { + "type": "string", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "permissions": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "type": "string", + "enum": [ + "SelfService.User", + "Incident.User", + "Incident.Manager", + "Incident.Read", + "Incident.Write", + "Incident.Delete", + "Request.User", + "Request.Manager", + "Request.Read", + "Request.Write", + "Request.Delete", + "Request.Execute", + "Change.User", + "Change.Manager", + "Change.Read", + "Change.Write", + "Change.Delete", + "Change.Approve", + "DataManagement.Admin", + "Tenant.Users.Manage", + "Tenant.Roles.Assign", + "Tenant.Settings.Manage", + "Tenant.Customers.Manage", + "Tenant.Sla.Manage" + ] + } + } + }, + "required": [ + "roleId", + "name", + "permissions" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_role. All operation-specific fields belong inside this request object, never at the tool root.", + "allOf": [ + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Execute" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Approve" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + } + ] + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_role", + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/role-definitions/{roleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete_role operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "HelpdeskAdmin or scoped role-management authority for ownerOrganizationId; only delegable permission intersection", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "roleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "roleId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "roleId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_role. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_request_form", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-forms", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create_request_form operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + }, + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "jsonSchema": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": [ + "string", + "null" + ] + }, + "allowedOrganizationIds": { + "type": "array", + "items": { + "type": "string" + } + }, + "releaseStatus": { + "enum": [ + 0, + 1 + ] + } + }, + "required": [ + "serviceId", + "title", + "jsonSchema" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_request_form. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_service_request_form", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/services/{serviceId}/forms/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create_service_request_form operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "serviceId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + }, + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "jsonSchema": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": [ + "string", + "null" + ] + }, + "allowedOrganizationIds": { + "type": "array", + "items": { + "type": "string" + } + }, + "releaseStatus": { + "enum": [ + 0, + 1 + ] + } + }, + "required": [ + "serviceId", + "title", + "jsonSchema" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_service_request_form. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "provision_user", + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/users/provision", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "provision_user operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Authenticated caller with verified email plus issuer/subject or provider-user-ID claims, an established customer login link, and enabled customer/organization; explicitly authorized external administrator may provision without a customer link. Request fields cannot choose another identity.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Verified external identity email plus issuer/subject or provider user identifier claims and an established customer login link (or explicitly authorized external administrator). This operation provisions the caller; request business fields cannot select another identity." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_organization_branding", + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenants/{tenantId}/branding", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update_organization_branding operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "tenantId", + "type": "integer", + "source": "helpdesk_organizations.tenants or tenant_lookup: integer tenant identifier; never an organizationId" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Positive integer tenantId from tenant lookup; organizationId is a different identifier and is not accepted." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": "integer", + "minimum": 1 + }, + "brandName": { + "type": [ + "string", + "null" + ] + }, + "logoUrl": { + "type": [ + "string", + "null" + ] + }, + "footerHtml": { + "type": [ + "string", + "null" + ] + }, + "primaryColor": { + "type": [ + "string", + "null" + ] + }, + "fromName": { + "type": [ + "string", + "null" + ] + }, + "replyTo": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "tenantId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_organization_branding. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_request_form", + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "update_request_form operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestFormId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "minLength": 1 + }, + "title": { + "type": [ + "string", + "null" + ] + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "jsonSchema": { + "type": [ + "string", + "null" + ] + }, + "serviceIdHasValue": { + "type": "boolean" + }, + "serviceId": { + "type": [ + "string", + "null" + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ] + }, + "allowedOrganizationIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "releaseStatus": { + "enum": [ + 0, + 1, + null + ] + } + }, + "required": [ + "requestFormId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_request_form. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_request_form", + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "delete_request_form operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestFormId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestFormId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_request_form. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_self_service_request", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/self-service/requests", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "create_self_service_request operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User or HelpdeskAdmin, audience-eligible request form and valid payload. Requested-for customer is resolved from the caller\u0027s linked customer or an explicit authorized requestedForPersonId/requestedForPersonSource selection in visible organizations.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Enabled requested-for customer/organization resolved through the caller\u0027s own link or explicit authorized requestedForPersonId plus requestedForPersonSource. Select a published/audience-eligible form and payloadJson matching its schema." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "minLength": 1 + }, + "title": { + "type": [ + "string", + "null" + ] + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "payloadJson": { + "type": "string" + }, + "requesterEmail": { + "type": [ + "string", + "null" + ] + }, + "requesterName": { + "type": [ + "string", + "null" + ] + }, + "requestedForPersonId": { + "type": [ + "string", + "null" + ] + }, + "requestedForPersonSource": { + "enum": [ + 0, + 1, + null + ] + } + }, + "required": [ + "requestFormId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_self_service_request. All operation-specific fields belong inside this request object, never at the tool root.", + "dependentRequired": { + "requestedForPersonId": [ + "requestedForPersonSource" + ] + } + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "customer_invite", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/invite", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "customer_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "customerId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation customer_invite. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "customer_resend_invite", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/resend-invite", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "customer_resend_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "customerId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation customer_resend_invite. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "customer_disable_login", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/disable-login", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "customer_disable_login manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "customerId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation customer_disable_login. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "customer_sync_authentik", + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/sync-authentik", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "customer_sync_authentik manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "customerId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation customer_sync_authentik. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + { + "tool": "helpdesk_automation", + "operation": "create_form", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-forms/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create a self-service request form with a typed fields/tasks schema. Set releaseStatus, audience and each automation task\u0027s autoStart deliberately. Task IDs and dependency IDs are UUIDs; the API validates the dependency graph and dataset bindings.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "title": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "schema": { + "type": "object", + "additionalProperties": false, + "properties": { + "fields": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "label": { + "type": "string", + "maxLength": 262144 + }, + "key": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "type": { + "type": "string", + "maxLength": 262144 + }, + "required": { + "type": "boolean" + }, + "dataBinding": { + "type": [ + "object", + "null" + ], + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "maxLength": 262144 + }, + "displayColumn": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "searchColumns": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "placeholder": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowFreeText": { + "type": "boolean" + }, + "minSearchLength": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [] + }, + "predefinedOptions": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + } + }, + "required": [] + } + }, + "tasks": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "order": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "type": { + "type": "string", + "maxLength": 262144 + }, + "autoStart": { + "type": "boolean" + }, + "defaultAssigneeId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "teamOrRole": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "orchestratorJobName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "payloadMapping": { + "type": [ + "object", + "null" + ], + "maxProperties": 100, + "additionalProperties": { + "type": "string", + "maxLength": 262144 + } + }, + "expectedRuntimeMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "graceRuntimeMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "dependsOn": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "conditionExpression": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "taskSlaMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "escalateAfterMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "escalationUserId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "escalationRole": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "isCritical": { + "type": "boolean" + }, + "maxRetries": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "retryDelayMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "failurePolicy": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "approvalAllowedDays": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "approvalApprovers": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "source": { + "type": "string", + "maxLength": 262144 + }, + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "email": { + "type": "string", + "maxLength": 262144 + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "organizationName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + } + }, + "required": [] + } + } + }, + "required": [] + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowedOrganizationIds": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "releaseStatus": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + null + ] + } + }, + "required": [ + "serviceId", + "title", + "schema" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "update_form", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Edit a self-service form through its typed fields/tasks schema; omitted audience and release status remain unchanged. Existing bindings are managed separately through binding operations.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestFormId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "schema": { + "type": "object", + "additionalProperties": false, + "properties": { + "fields": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "label": { + "type": "string", + "maxLength": 262144 + }, + "key": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "type": { + "type": "string", + "maxLength": 262144 + }, + "required": { + "type": "boolean" + }, + "dataBinding": { + "type": [ + "object", + "null" + ], + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "maxLength": 262144 + }, + "displayColumn": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "searchColumns": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "placeholder": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowFreeText": { + "type": "boolean" + }, + "minSearchLength": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [] + }, + "predefinedOptions": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + } + }, + "required": [] + } + }, + "tasks": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "order": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "type": { + "type": "string", + "maxLength": 262144 + }, + "autoStart": { + "type": "boolean" + }, + "defaultAssigneeId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "teamOrRole": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "orchestratorJobName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "payloadMapping": { + "type": [ + "object", + "null" + ], + "maxProperties": 100, + "additionalProperties": { + "type": "string", + "maxLength": 262144 + } + }, + "expectedRuntimeMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "graceRuntimeMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "dependsOn": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "conditionExpression": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "taskSlaMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "escalateAfterMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "escalationUserId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "escalationRole": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "isCritical": { + "type": "boolean" + }, + "maxRetries": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "retryDelayMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "failurePolicy": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "approvalAllowedDays": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "approvalApprovers": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "source": { + "type": "string", + "maxLength": 262144 + }, + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "email": { + "type": "string", + "maxLength": 262144 + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "organizationName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + } + }, + "required": [] + } + } + }, + "required": [] + }, + "title": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowedOrganizationIds": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "releaseStatus": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + null + ] + }, + "serviceIdHasValue": { + "type": [ + "boolean", + "null" + ] + }, + "serviceId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [ + "schema" + ] + } + }, + "required": [ + "requestFormId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "create_request_definition", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/catalog/request-definitions", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create a provider automation target using the selected saved organization mapping. This creates a request definition through the supported provider adapter.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 262144 + }, + "folderPath": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "tenantId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "clientIdentity": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [ + "name", + "clientIdentity" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "bindings", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List automation bindings, optionally for one request form.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "get_binding", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read one saved automation binding.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "bindingId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "binding_by_task", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings/by-task", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Resolve the binding for one task template in one form.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "taskTemplateId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "requestFormId", + "taskTemplateId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "create_binding", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Bind a form task template to a provider request definition through a saved connection.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "systemConnectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "requestFormId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "taskTemplateId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "orchestrationRequestDefinitionId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "orchestrationRequestDefinitionName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "orchestrationJobDefinitionId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "orchestrationJobDefinitionName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [ + "requestFormId", + "taskTemplateId", + "orchestrationRequestDefinitionId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "update_binding", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update or enable/disable an existing automation binding. Omitted properties retain their current values; explicit clear fields remove optional values.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "bindingId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "systemConnectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "orchestrationRequestDefinitionId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "orchestrationRequestDefinitionName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearOrchestrationRequestDefinitionName": { + "type": [ + "boolean", + "null" + ] + }, + "orchestrationJobDefinitionId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearOrchestrationJobDefinitionId": { + "type": [ + "boolean", + "null" + ] + }, + "orchestrationJobDefinitionName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearOrchestrationJobDefinitionName": { + "type": [ + "boolean", + "null" + ] + }, + "syncState": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + 3, + null + ] + }, + "lastSyncHash": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearLastSyncHash": { + "type": [ + "boolean", + "null" + ] + }, + "lastSyncVersion": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearLastSyncVersion": { + "type": [ + "boolean", + "null" + ] + }, + "lastSyncedAtUtc": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "clearLastSyncedAtUtc": { + "type": [ + "boolean", + "null" + ] + }, + "lastSyncDirection": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearLastSyncDirection": { + "type": [ + "boolean", + "null" + ] + }, + "lastReviewedDriftAtUtc": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "clearLastReviewedDriftAtUtc": { + "type": [ + "boolean", + "null" + ] + }, + "lastCorrelationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearLastCorrelationId": { + "type": [ + "boolean", + "null" + ] + }, + "enabled": { + "type": [ + "boolean", + "null" + ] + } + }, + "required": [] + } + }, + "required": [ + "bindingId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "delete_binding", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete one automation binding.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "bindingId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "sync_binding_inputs", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/sync-inputs", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Synchronize the form task inputs with its bound automation target.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "bindingId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "refresh_binding_drift", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/refresh-drift", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Refresh provider schema drift for saved bindings, optionally limited to a form.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "mark_binding_import_pending", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/mark-import-pending", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Mark a binding for explicit reviewed schema import.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "bindingId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "binding_drift_preview", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/drift-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Compare the saved form inputs and provider target schema before importing.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "bindingId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "import_binding_inputs", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/import-inputs", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Import the bound provider input definitions into the form task template.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "bindingId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "approver_candidates", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-task-approvers", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Find designated user/customer approval candidates for a self-service task template.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "my_task_approval", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-tasks/{taskId}/approval/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the caller\u0027s assigned approval. Even an owner grant cannot impersonate another designated approver.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Stored designated approver identity plus Request.User, SelfService.User or request management authority in the request organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "taskId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "taskId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "approve_task", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/approval/approve", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Approve the caller\u0027s own assigned pending task before its deadline; resumes the workflow. Repeating the same accepted decision is idempotent.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Stored designated approver identity plus Request.User, SelfService.User or request management authority in the request organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "taskId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "taskId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "reject_task", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/approval/reject", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Reject the caller\u0027s own assigned pending task with a reason through the canonical cancellation and notification lifecycle.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Stored designated approver identity plus Request.User, SelfService.User or request management authority in the request organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "taskId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "reason": { + "type": "string", + "maxLength": 1000, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "reason" + ] + } + }, + "required": [ + "taskId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "workflow_timeline", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/workflow-timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read independently persisted request workflow events, including provider execution identities and effects.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Manager in the request organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + }, + "includePayload": { + "type": [ + "boolean", + "null" + ] + }, + "correlationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "categories": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "sinceUtc": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "requestId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "requestId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "overdue_tasks", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/overdue", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read bounded workflow operational evidence and pending recovery work.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "escalated_tasks", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/escalated", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read bounded workflow operational evidence and pending recovery work.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "pending_retries", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/retries-pending", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read bounded workflow operational evidence and pending recovery work.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "critical_failures", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/critical-failures", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read bounded workflow operational evidence and pending recovery work.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + }, + "sinceUtc": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "callback_rejections", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/orchestration/callback-rejections", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read bounded workflow operational evidence and pending recovery work.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + }, + "lookbackDays": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 30 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "binding_issues", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/orchestration/binding-issues", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read bounded workflow operational evidence and pending recovery work.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "workflow_metrics", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/metrics/workflows", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read organization-filtered workflow operational counters as Prometheus text.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Request.Read, Request.Write or Request.Manager in the selected organizations; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_attachments", + "operation": "list", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tickets/{ticketId}/attachments/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List authorized attachment metadata for an incident, request or change.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Parent ticket visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_attachments", + "operation": "download", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/attachments/{attachmentId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read a bounded attachment as base64 with its media type and filename; maximum file size is 1 MiB.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Parent ticket visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "attachmentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "attachmentId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "attachmentId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_attachments", + "operation": "upload", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/attachments/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Upload one base64 attachment, at most 1 MiB, using the authenticated multipart endpoint. The API enforces the parent ticket\u0027s authority.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Parent ticket manager or authorized self-service owner; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "fileName": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "pattern": "^(?!\\.{1,2}$)[^/\\\\\\u0000-\\u001F\\u007F-\\u009F]\u002B$", + "examples": [ + "fixture.png" + ] + }, + "contentType": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "^[A-Za-z0-9!#$\u0026^_.\u002B-]\u002B/[A-Za-z0-9!#$\u0026^_.\u002B-]\u002B$", + "examples": [ + "image/png" + ] + }, + "contentBase64": { + "type": "string", + "maxLength": 1398104, + "minLength": 1, + "pattern": "^(?:[A-Za-z0-9\u002B/]{4})*(?:[A-Za-z0-9\u002B/]{2}==|[A-Za-z0-9\u002B/]{3}=)?$", + "examples": [ + "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + ], + "description": "Base64 file bytes, 1 byte through 1 MiB after decoding. No data-URL prefix or embedded whitespace." + } + }, + "required": [ + "fileName", + "contentType", + "contentBase64" + ] + } + }, + "required": [ + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_auth", + "operation": "revoke_self", + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/integration-credentials/self/revoke", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Revoke the credential used by this request. The next authenticated call will fail until a separately authorized credential is supplied. This cannot issue or broaden another credential.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current API integration credential or source MCP execution credential; setup verifier excluded; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_connections", + "operation": "list", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/system-connections/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List saved system connections and their health without returning peer credentials.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_connections", + "operation": "generate_pairing_code", + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/admin/system-connections/code", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Generate an expiring single-use system pairing code as a sensitive result. Deliver only to the authorized peer setup workflow; exclude it from campaign evidence and logs.", + "sensitiveResultFields": [ + "code" + ], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_connections", + "operation": "pair", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/system-connections/pair", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Connect to an explicitly selected peer using its supplied short-lived write-only pairing code. Reuse the same operationId when reading the result of an uncertain attempt; the canonical signed peer protocol, address validation and owner checks apply.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "address": { + "type": "string", + "maxLength": 2048, + "minLength": 1, + "pattern": "\\S" + }, + "pairingCode": { + "type": "string", + "maxLength": 32, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it.", + "minLength": 1, + "pattern": "\\S" + }, + "operationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "address", + "pairingCode", + "operationId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "directory", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/directory", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read authorized organization, customer and provider-tenant choices for a saved pair.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "pairId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "pairId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "save_mapping", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/mappings/{mappingId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create or update a named organization/provider mapping on an existing securely paired peer. body.id must equal mappingId and body.pairId must equal pairId.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "pairId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "mappingId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "mappingId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "pairId": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "netRatelTenantId": { + "type": "string", + "maxLength": 262144 + }, + "ratelDeskOrganizationId": { + "type": "string", + "maxLength": 262144 + }, + "ratelDeskCustomerId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "createIncidents": { + "type": "boolean" + }, + "runAutomation": { + "type": "boolean" + } + }, + "required": [ + "id", + "pairId", + "name", + "netRatelTenantId", + "ratelDeskOrganizationId", + "createIncidents", + "runAutomation" + ] + } + }, + "required": [ + "pairId", + "mappingId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "test_mapping", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/mappings/{mappingId}/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Test the exact saved mapping\u0027s approved capabilities and organization binding.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "pairId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "mappingId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "mappingId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [ + "pairId", + "mappingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "delete_mapping", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/mappings/{mappingId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Remove one saved named mapping from the paired systems.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "pairId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "mappingId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "mappingId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [ + "pairId", + "mappingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "delete_pair", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete a saved pair and its mappings through the supported cleanup lifecycle.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "pairId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "pairId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "netclaw_settings", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/netclaw/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read saved Netclaw connectivity metadata with secret-state flags.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_connections", + "operation": "update_netclaw_settings", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/netclaw/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update Netclaw connectivity settings with optional write-only device-token replacement or explicit clearing. Omit the token to preserve its protected saved value. expectedRevision enforces concurrent-update detection.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedRevision": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "enabled": { + "type": "boolean" + }, + "instance": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "endpoint": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowPrivateHttp": { + "type": "boolean" + }, + "idleMinutes": { + "type": "integer", + "minimum": 1, + "maximum": 1440 + }, + "connectionCapacity": { + "type": "integer", + "minimum": 1, + "maximum": 1000 + }, + "turnInactivityTimeout": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "activityHeartbeatInterval": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "deviceToken": { + "type": [ + "string", + "null" + ], + "maxLength": 262144, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearDeviceToken": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "test_netclaw", + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Test the saved Netclaw connection and authenticated session protocol.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_connections", + "operation": "test_netclaw_draft", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/test-draft", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Test an explicit Netclaw settings draft through the authenticated session protocol without saving it. Omitted deviceToken retains the saved credential only where its endpoint binding matches. Read the saved profile and revision first.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedRevision": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "enabled": { + "type": "boolean" + }, + "instance": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "endpoint": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowPrivateHttp": { + "type": "boolean" + }, + "idleMinutes": { + "type": "integer", + "minimum": 1, + "maximum": 1440 + }, + "connectionCapacity": { + "type": "integer", + "minimum": 1, + "maximum": 1000 + }, + "turnInactivityTimeout": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "activityHeartbeatInterval": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "deviceToken": { + "type": [ + "string", + "null" + ], + "maxLength": 262144, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearDeviceToken": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "pair_netclaw", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/pair-and-save", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Exchange a supplied one-time Netclaw pairing code, save the resulting protected device credential, and verify the authenticated session. Read netclaw_settings first and supply its current expectedRevision. If older unbound conversations exist, inspect netclaw_unbound_sessions and confirm their actual historical provider with confirm_netclaw_session_owner before pairing. On conflict or uncertain verification read the saved profile; a consumed pairing code must not be blindly replayed. Native Netclaw pairing requires its PostgreSQL durable-session capability.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairingCode": { + "type": "string", + "maxLength": 1024, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it.", + "minLength": 1, + "pattern": "\\S" + }, + "expectedRevision": { + "type": "integer", + "minimum": 0, + "maximum": 2147483647 + }, + "endpoint": { + "type": "string", + "maxLength": 2048, + "minLength": 1, + "pattern": "\\S" + }, + "enabled": { + "type": "boolean" + }, + "instance": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "allowPrivateHttp": { + "type": "boolean" + }, + "idleMinutes": { + "type": "integer", + "minimum": 1, + "maximum": 1440 + }, + "connectionCapacity": { + "type": "integer", + "minimum": 1, + "maximum": 1000 + }, + "turnInactivityTimeout": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "activityHeartbeatInterval": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "legacyOwnershipReviewToken": { + "type": [ + "string", + "null" + ], + "maxLength": 128, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + } + }, + "required": [ + "pairingCode", + "expectedRevision", + "endpoint", + "enabled" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "netclaw_unbound_sessions", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/netclaw/legacy-sessions/unbound", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the exact legacy conversation IDs, ticket and organization context that still need historical Netclaw provider ownership confirmation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_connections", + "operation": "confirm_netclaw_session_owner", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/legacy-sessions/confirm-owner", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Bind explicitly reviewed legacy conversation IDs to their actual historical Netclaw endpoint and instance. expectedEligibleConversations must equal the unique submitted IDs. The API compares current eligibility and commits its owner audit; reload on a conflict before submitting a new reviewed selection.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "historicalEndpoint": { + "type": "string", + "maxLength": 2048, + "minLength": 1, + "pattern": "\\S" + }, + "expectedEligibleConversations": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "conversationIds": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "minItems": 1 + }, + "historicalInstance": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "allowPrivateHttp": { + "type": "boolean" + } + }, + "required": [ + "historicalEndpoint", + "expectedEligibleConversations", + "conversationIds" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "organizations", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List the organizations the caller can administer.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Tenant membership/settings administration or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "settings", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/settings/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read one organization\u0027s display and contact settings.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Tenant.Settings.Manage in organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "update_settings", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/settings/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update one organization\u0027s display and contact settings.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Tenant.Settings.Manage in organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "contactInfo": { + "type": [ + "string", + "null" + ], + "maxLength": 4000 + } + }, + "required": [ + "name" + ] + } + }, + "required": [ + "organizationId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "members", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List local team members and their scoped role assignments.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Tenant user read/manage authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "delegable_roles", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/roles", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List operational built-in and tenant-owned roles that may be delegated in this organization.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Tenant role-management authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "assignments", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/{userId}/assignments", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the selected local user\u0027s role assignments within this organization.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Tenant role-management authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "organizationId", + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "replace_assignments", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/{userId}/assignments", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Replace the selected local user\u0027s delegable role assignments; an empty list removes those assignments. Other scopes and instance-admin authority remain governed by the API.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Tenant role-management authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "roleKeys": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + } + }, + "required": [ + "roleKeys" + ] + } + }, + "required": [ + "organizationId", + "userId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "create_local_account", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create a local account and return its newly issued one-time activation token as an explicitly sensitive result. This does not read an existing password. Deliver the token only through the authorized private activation workflow.", + "sensitiveResultFields": [ + "activationToken" + ], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "displayName": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "email": { + "type": "string", + "maxLength": 254, + "minLength": 1, + "pattern": "\\S" + }, + "isInstanceAdministrator": { + "type": "boolean" + }, + "role": { + "type": "string", + "maxLength": 262144, + "enum": [ + "User", + "Technician" + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "isTestUser": { + "type": "boolean" + } + }, + "required": [ + "displayName", + "email" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "reset_local_account", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users/{userId}/activation-token", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Issue a new one-time local-account activation token as an explicitly sensitive result; preserve it only through the authorized private activation workflow.", + "sensitiveResultFields": [ + "activationToken" + ], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "reset_customer_login", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/local-activation-token", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Issue a new one-time activation token for the customer\u0027s single linked enabled local account. Inspect helpdesk_customers.auth_status first; external customer invite/resend/sync flows have their separate identity-provider contract.", + "sensitiveResultFields": [ + "activationToken" + ], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "customerId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "customerId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "local_account_status", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/local-auth/users/{userId}/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read a local account\u0027s enabled status.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "disable_local_account", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users/{userId}/disable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Disable a local account through the existing administrator lifecycle, including session/credential invalidation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "enable_local_account", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users/{userId}/enable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Enable a disabled local account.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "local_account_assignments", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/local-auth/users/{userId}/assignments", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read all scoped role assignments and local/instance-administrator flags for one account.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "replace_local_account_assignments", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/local-auth/users/{userId}/assignments", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Replace the selected non-instance-admin account\u0027s explicit scoped role assignments; each role and organization is validated by the API.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "assignments": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "roleKey": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "organizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "roleKey", + "organizationId" + ] + } + } + }, + "required": [ + "assignments" + ] + } + }, + "required": [ + "userId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "pending", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/pending", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Search pending deliveries with bounded paging, status, recipient and organization filters. Delivery state is distinct from queue acceptance.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "search": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "status": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "sender": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "recipient": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "reason": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "from": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "to": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "sort": { + "type": "string", + "maxLength": 262144, + "pattern": "^(created|status|recipient|ticket)$" + }, + "descending": { + "type": "boolean" + }, + "page": { + "type": "integer", + "minimum": 0, + "maximum": 1000000 + }, + "pageSize": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647, + "enum": [ + 25, + 50, + 100 + ] + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "pending_count", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/timeline/pending-count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the number of failed deliveries awaiting review or retry.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_mail", + "operation": "failed", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/timeline/failed", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read up to 100 failed delivery events including retry eligibility and recipient outcome evidence.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_mail", + "operation": "retry", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Retry one eligible failed delivery. Uncertain, partially accepted or changed-sender deliveries require their separate reviewed retry operation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "deliveryId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "deliveryId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "outgoing_retry_preview", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/{deliveryId}/outgoing-retry-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the current outgoing revision and fence required before retrying a reviewed sender configuration.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "deliveryId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "deliveryId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "retry_current_outgoing", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry-current-outgoing", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Retry using the reviewed outgoing configuration with its expected revisions and fence. Preserve the preview values in the request.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "deliveryId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedOutgoingVersion": { + "type": "integer", + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "confirmed": { + "type": "boolean" + }, + "expectedMailboxId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "expectedMailboxVersion": { + "type": [ + "integer", + "null" + ], + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "expectedFence": { + "type": [ + "integer", + "null" + ], + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + } + }, + "required": [ + "expectedOutgoingVersion", + "expectedMailboxId", + "expectedMailboxVersion", + "expectedFence", + "confirmed" + ] + } + }, + "required": [ + "deliveryId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "uncertain_retry_preview", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/{deliveryId}/uncertain-retry-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read an uncertain delivery\u0027s current fence, sender and recipients before independently establishing whether delivery occurred.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "deliveryId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "deliveryId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "retry_confirmed_undelivered", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry-confirmed-undelivered", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Retry an uncertain delivery only after independent evidence confirms no delivery. The API retains evidence, outcome and fence checks.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "deliveryId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedFence": { + "type": "integer", + "minimum": 0, + "maximum": 9223372036854780000 + }, + "expectedOutgoingVersion": { + "type": "integer", + "minimum": 1, + "maximum": 9223372036854780000 + }, + "evidenceReference": { + "type": "string", + "maxLength": 262144, + "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]{7,127}$", + "minLength": 1 + }, + "confirmedNoDelivery": { + "type": "boolean" + } + }, + "required": [ + "evidenceReference", + "expectedFence", + "expectedOutgoingVersion", + "confirmedNoDelivery" + ] + } + }, + "required": [ + "deliveryId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "changed_route_preview", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/{deliveryId}/changed-route-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the old and current sender routes and all revisions before approving a route change.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "deliveryId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "deliveryId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "retry_current_route", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry-current-route", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Retry with an explicitly reviewed new sender using the exact route-preview identifiers and revisions.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "deliveryId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedFence": { + "type": "integer", + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "expectedOriginalMailboxId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "expectedCurrentMailboxId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "expectedMailboxVersion": { + "type": "integer", + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "expectedOutgoingVersion": { + "type": "integer", + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "confirmedNewSender": { + "type": "boolean" + } + }, + "required": [ + "expectedFence", + "expectedOriginalMailboxId", + "expectedCurrentMailboxId", + "expectedMailboxVersion", + "expectedOutgoingVersion", + "confirmedNewSender" + ] + } + }, + "required": [ + "deliveryId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "pending_organizations", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/pending/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Look up organizations for pending-delivery filtering; returns at most 50 matches.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 100 + }, + "id": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "take": { + "type": "integer", + "minimum": 1, + "maximum": 50 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "pending_actions", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/pending/actions", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Apply retry, cancel or remove to 1\u2013100 explicitly selected delivery IDs with a recorded reason. The API reauthorizes and reports each result independently.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "minItems": 1 + }, + "action": { + "type": "string", + "maxLength": 262144, + "pattern": "^(retry|cancel|remove)$", + "minLength": 1 + }, + "reason": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "confirmed": { + "type": "boolean" + } + }, + "required": [ + "ids", + "action", + "reason", + "confirmed" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "send", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email/send", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Send an administrator-authored message through the configured mail service to explicitly supplied recipients. For ticket replies use the ticket add_worklog operation with isInternalNote=false.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "recipients": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + }, + "minItems": 1 + }, + "subject": { + "type": "string", + "maxLength": 998, + "minLength": 1, + "pattern": "\\S" + }, + "htmlMessage": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "recipients", + "subject", + "htmlMessage" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_mail", + "operation": "test_provider", + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/email/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Test availability of the configured email provider.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_email_settings", + "operation": "list", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read saved mailbox settings with stored secrets redacted by the API.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_email_settings", + "operation": "get", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/{mailboxId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read one saved mailbox configuration and its concurrency version.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "effective", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/effective", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read each organization\u0027s effective dedicated or inherited mailbox route.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_email_settings", + "operation": "worker_status", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/worker", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the persisted instance mailbox worker decision and deployment-level ingestion status.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_email_settings", + "operation": "set_worker", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/worker", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Persist an explicitly confirmed mailbox worker run/pause decision. Deployment-level disabled ingestion remains authoritative.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "running": { + "type": "boolean" + }, + "confirmed": { + "type": "boolean" + } + }, + "required": [ + "running", + "confirmed" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "create", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create a mailbox with explicitly supplied write-only credentials. Credential values never appear in the preview or normal readback; create does not import mail implicitly.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "displayName": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "provider": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "authentication": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "scope": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "version": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "username": { + "type": "string", + "maxLength": 254 + }, + "password": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearPassword": { + "type": "boolean" + }, + "clientSecret": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearClientSecret": { + "type": "boolean" + }, + "confirmExistingImport": { + "type": "boolean" + }, + "initialImport": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "tlsMode": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "processedFolder": { + "type": [ + "string", + "null" + ], + "maxLength": 512 + }, + "markReadAfterSuccess": { + "type": "boolean" + }, + "pollIntervalSeconds": { + "type": "integer", + "minimum": 10, + "maximum": 300 + }, + "batchSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "mailHost": { + "type": "string", + "maxLength": 253 + }, + "port": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + }, + "useSsl": { + "type": "boolean" + }, + "mailboxAddress": { + "type": "string", + "maxLength": 254, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": "string", + "maxLength": 200 + }, + "clientId": { + "type": "string", + "maxLength": 200 + }, + "mailboxFolder": { + "type": "string", + "maxLength": 512 + }, + "enabled": { + "type": "boolean" + }, + "backgroundSyncEnabled": { + "type": "boolean" + } + }, + "required": [ + "displayName", + "mailboxAddress", + "provider", + "authentication", + "scope" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "update", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-settings/{mailboxId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Save the complete mailbox configuration using the current version. Secret fields are write-only; omitted or empty values preserve saved secrets unless the corresponding clear flag is true.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "displayName": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "provider": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "authentication": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "scope": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "version": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "username": { + "type": "string", + "maxLength": 254 + }, + "password": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearPassword": { + "type": "boolean" + }, + "clientSecret": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearClientSecret": { + "type": "boolean" + }, + "confirmExistingImport": { + "type": "boolean" + }, + "initialImport": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "tlsMode": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "processedFolder": { + "type": [ + "string", + "null" + ], + "maxLength": 512 + }, + "markReadAfterSuccess": { + "type": "boolean" + }, + "pollIntervalSeconds": { + "type": "integer", + "minimum": 10, + "maximum": 300 + }, + "batchSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "mailHost": { + "type": "string", + "maxLength": 253 + }, + "port": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + }, + "useSsl": { + "type": "boolean" + }, + "mailboxAddress": { + "type": "string", + "maxLength": 254, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": "string", + "maxLength": 200 + }, + "clientId": { + "type": "string", + "maxLength": 200 + }, + "mailboxFolder": { + "type": "string", + "maxLength": 512 + }, + "enabled": { + "type": "boolean" + }, + "backgroundSyncEnabled": { + "type": "boolean" + } + }, + "required": [ + "displayName", + "mailboxAddress", + "version", + "provider", + "authentication", + "scope" + ] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "test_mailbox", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Test a saved inbound mailbox configuration and retain its test result against the saved revision.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "test_draft_mailbox", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Test explicitly supplied draft mailbox settings and write-only credentials without saving the configuration or importing mail.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "displayName": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "provider": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "authentication": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "scope": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "version": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "username": { + "type": "string", + "maxLength": 254 + }, + "password": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearPassword": { + "type": "boolean" + }, + "clientSecret": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearClientSecret": { + "type": "boolean" + }, + "confirmExistingImport": { + "type": "boolean" + }, + "initialImport": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "tlsMode": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "processedFolder": { + "type": [ + "string", + "null" + ], + "maxLength": 512 + }, + "markReadAfterSuccess": { + "type": "boolean" + }, + "pollIntervalSeconds": { + "type": "integer", + "minimum": 10, + "maximum": 300 + }, + "batchSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "mailHost": { + "type": "string", + "maxLength": 253 + }, + "port": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + }, + "useSsl": { + "type": "boolean" + }, + "mailboxAddress": { + "type": "string", + "maxLength": 254, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": "string", + "maxLength": 200 + }, + "clientId": { + "type": "string", + "maxLength": 200 + }, + "mailboxFolder": { + "type": "string", + "maxLength": 512 + }, + "enabled": { + "type": "boolean" + }, + "backgroundSyncEnabled": { + "type": "boolean" + } + }, + "required": [ + "displayName", + "mailboxAddress", + "provider", + "authentication", + "scope" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "enable", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/enable", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Enable one saved mailbox through its canonical readiness and credential checks.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "disable", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/disable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Disable one saved mailbox without deleting its history or credentials.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "sync", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/sync", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Queue a sync of one configured mailbox and report queued versus unavailable state.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "archive", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/archive", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Archive a mailbox using its current version and explicit confirmation. This changes organization routing through the same canonical transaction used by the UI.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "version": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "confirmed": { + "type": "boolean" + } + }, + "required": [ + "version", + "confirmed" + ] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "diagnostics", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/diagnostics", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read bounded mailbox receipt, cursor and worker diagnostics without secrets.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "retry_receipt", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/receipts/{receiptId}/retry", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Queue retry of one eligible inbound receipt. The server checks outcome eligibility and concurrent changes.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "receiptId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "receiptId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId", + "receiptId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "historical_preview", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/historical/preview", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Inspect 1\u201350 eligible historical mailbox messages without importing them; retain the returned receipt identities for a selected import.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "fromUnixMilliseconds": { + "type": [ + "integer", + "null" + ], + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "toUnixMilliseconds": { + "type": [ + "integer", + "null" + ], + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "count": { + "type": "integer", + "minimum": 1, + "maximum": 50 + }, + "skip": { + "type": "integer", + "minimum": 0, + "maximum": 10000 + } + }, + "required": [] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "historical_import", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/historical/import", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Queue only the explicitly confirmed historical receipt selection. Import eligibility, duplicates and mailbox state remain server-validated.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "receiptIds": { + "type": "array", + "maxItems": 25, + "items": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "minItems": 1 + }, + "confirmed": { + "type": "boolean" + } + }, + "required": [ + "receiptIds", + "confirmed" + ] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "outgoing", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the mailbox\u0027s outgoing sender configuration and version with credentials redacted.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "save_outgoing", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Save complete outgoing sender configuration with optimistic concurrency. Supply smtpPassword as an empty string to retain its saved value, a new write-only value to rotate it, or clearSmtpPassword=true to remove it.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "version": { + "type": "integer", + "minimum": 0, + "maximum": 2147483647 + }, + "enabled": { + "type": "boolean" + }, + "transport": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "displayName": { + "type": "string", + "maxLength": 200 + }, + "smtpHost": { + "type": "string", + "maxLength": 253 + }, + "smtpPort": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + }, + "smtpTlsMode": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "smtpUsername": { + "type": "string", + "maxLength": 320 + }, + "smtpPassword": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearSmtpPassword": { + "type": "boolean" + } + }, + "required": [ + "version", + "enabled", + "transport", + "displayName", + "smtpHost", + "smtpPort", + "smtpTlsMode", + "smtpUsername", + "smtpPassword" + ] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "test_outgoing", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Test authentication of the saved outgoing transport and record the tested revision.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "send_test", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing/send-test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Send one explicitly confirmed sample message to one recipient using the saved sender. Acceptance by the provider is reported separately from final delivery.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "mailboxId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "recipient": { + "type": "string", + "maxLength": 254, + "minLength": 1, + "pattern": "\\S" + }, + "confirmed": { + "type": "boolean" + } + }, + "required": [ + "recipient", + "confirmed" + ] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "rules", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/inbound-email-rules/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List inbound routing rules for a tenant and/or mailbox.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "get_rule", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read an inbound email rule including its typed conditions and actions.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ruleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "create_rule", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create a typed inbound mail rule, including authorized forwarded-sender processing; configured tenant/mailbox checks remain enforced.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "enabled": { + "type": "boolean" + }, + "priority": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "conditions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5 + ] + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "permissions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + } + }, + "required": [] + } + }, + "actions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0 + ] + }, + "actionKey": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + }, + "stopProcessing": { + "type": "boolean" + } + }, + "required": [ + "scopeType", + "name", + "enabled", + "priority", + "conditions", + "actions", + "stopProcessing" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "update_rule", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Replace the typed settings of one inbound email rule.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ruleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "enabled": { + "type": "boolean" + }, + "priority": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "conditions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5 + ] + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "permissions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + } + }, + "required": [] + } + }, + "actions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0 + ] + }, + "actionKey": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + }, + "stopProcessing": { + "type": "boolean" + } + }, + "required": [ + "scopeType", + "name", + "enabled", + "priority", + "conditions", + "actions", + "stopProcessing" + ] + } + }, + "required": [ + "ruleId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "enable_rule", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}/enable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Enable one inbound rule after canonical binding validation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ruleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "disable_rule", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}/disable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Disable one inbound rule while retaining its audit history.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ruleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "reorder_rules", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/reorder", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Reorder an explicitly selected distinct set of rules in one tenant/mailbox scope.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "rules": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "priority": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [] + } + } + }, + "required": [ + "rules" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "rule_audit", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/inbound-email-rules/audit", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read up to 200 inbound rule processing outcomes filtered by ticket, message, tenant or mailbox.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "messageId": { + "type": [ + "string", + "null" + ], + "maxLength": 512 + }, + "ticketId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "templates", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-templates/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read saved email templates.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_email_settings", + "operation": "create_template", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-templates/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create a custom email template using the canonical HTML sanitizer.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "subject": { + "type": "string", + "maxLength": 998, + "minLength": 1, + "pattern": "\\S" + }, + "htmlContent": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "layoutId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [ + "name", + "subject", + "htmlContent" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "update_template", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-templates/{templateId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update template content while the API preserves identity and increments its version.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "templateId", + "type": "integer", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "templateId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "subject": { + "type": "string", + "maxLength": 998, + "minLength": 1, + "pattern": "\\S" + }, + "htmlContent": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "layoutId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [ + "name", + "subject", + "htmlContent" + ] + } + }, + "required": [ + "templateId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "delete_template", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/email-templates/{templateId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete a custom template; protected system templates remain undeletable.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "templateId", + "type": "integer", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "templateId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + } + }, + "required": [ + "templateId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "preview_template", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-templates/preview", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Render a saved or draft email template using a selected tenant\u0027s branding without sending a message.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "templateId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "templateName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "draftSubject": { + "type": [ + "string", + "null" + ], + "maxLength": 998 + }, + "draftHtmlContent": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "draftLayoutHtml": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "draftLayoutId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "sampleContext": { + "type": [ + "object", + "null" + ], + "additionalProperties": false, + "properties": { + "userName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "ticketRef": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "ticketLink": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "updateMessageHtml": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "updateMessageText": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "serviceName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "requestTitle": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "requestDescription": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "requestApprovalTaskName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "requestApprovalApprover": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "requestApprovalRejectionReason": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "failureReason": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "incidentRef": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "incidentLink": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "completedAt": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "resolvedAt": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeTitle": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeDescription": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeType": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changePriority": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeOrganization": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeRequestedFor": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeImplementor": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeApprovers": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeImplementationStart": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeImplementationEnd": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeApprovalLink": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeViewLink": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeCompletionState": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeScopeOfChange": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeAffectedSystems": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeImplementationSteps": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeValidationSteps": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeRollbackPlan": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeRollbackReference": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "organizationName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "inviteLink": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "inviteExpiresAt": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "helpdeskUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + }, + "required": [] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "upload_template_image", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-templates/{templateName}/images", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Upload one inline template image, at most 1 MiB, through the authenticated multipart endpoint and return its stored image URL.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "templateName", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "templateName": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "fileName": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "pattern": "^(?!\\.{1,2}$)[^/\\\\\\u0000-\\u001F\\u007F-\\u009F]\u002B$", + "examples": [ + "fixture.png" + ] + }, + "contentType": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "^image/[A-Za-z0-9!#$\u0026^_.\u002B-]\u002B$", + "examples": [ + "image/png" + ] + }, + "contentBase64": { + "type": "string", + "maxLength": 1398104, + "minLength": 1, + "pattern": "^(?:[A-Za-z0-9\u002B/]{4})*(?:[A-Za-z0-9\u002B/]{2}==|[A-Za-z0-9\u002B/]{3}=)?$", + "examples": [ + "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + ], + "description": "Base64 file bytes, 1 byte through 1 MiB after decoding. No data-URL prefix or embedded whitespace." + } + }, + "required": [ + "fileName", + "contentType", + "contentBase64" + ] + } + }, + "required": [ + "templateName", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "layouts", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-layouts/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read saved email layouts, optionally scoped to an integer tenant ID.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 2147483647 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "layout_choices", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-layouts/choices", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read selectable system and current-tenant email layouts.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_email_settings", + "operation": "create_layout", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-layouts/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create a custom email layout with canonical HTML sanitization.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "htmlContent": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [ + "name", + "htmlContent" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "update_layout", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-layouts/{layoutId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update layout content while preserving identity and system protection.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "layoutId", + "type": "integer", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "layoutId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "htmlContent": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [ + "name", + "htmlContent" + ] + } + }, + "required": [ + "layoutId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "delete_layout", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/email-layouts/{layoutId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete one custom layout; protected system layouts remain undeletable.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "layoutId", + "type": "integer", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "layoutId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + } + }, + "required": [ + "layoutId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "groups", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/groups/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List support groups, optionally for one owning organization.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "owningOrganizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "get_group", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/groups/{groupId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read one support group.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "groupId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "groupId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "create_group", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/groups/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create a support group in its owning organization.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "owningOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "name": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "owningOrganizationId", + "name" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "update_group", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/groups/{groupId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update support group metadata and enabled status.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "groupId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "owningOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "name": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "owningOrganizationId", + "name" + ] + } + }, + "required": [ + "groupId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "delete_group", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/groups/{groupId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete one support group through the canonical repository rules.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "groupId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "groupId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "members", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List the selected support group\u0027s members and enabled state.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "groupId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "groupId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "add_member", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Add an existing user to the selected support group with explicit membership role and source.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "groupId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "role": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "source": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "userId" + ] + } + }, + "required": [ + "groupId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "update_member", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/{memberId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update or disable an existing membership; the API verifies that it belongs to the selected group.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "groupId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "memberId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "memberId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "role": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "source": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [] + } + }, + "required": [ + "groupId", + "memberId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "remove_member", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/{memberId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Remove one membership from its verified group.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "groupId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "memberId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "memberId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "groupId", + "memberId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "coverage", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/coverage/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List customer-to-provider support coverage routes.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "create_coverage", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/coverage/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create explicit customer, provider and group coverage with a primary or backup role.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "providerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "supportGroupId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "role": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "customerOrganizationId", + "providerOrganizationId", + "supportGroupId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "update_coverage", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/coverage/{coverageId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update or disable a saved support coverage route.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "coverageId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "coverageId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "providerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "supportGroupId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "role": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "customerOrganizationId", + "providerOrganizationId", + "supportGroupId" + ] + } + }, + "required": [ + "coverageId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "delete_coverage", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/coverage/{coverageId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete one explicitly selected support coverage route.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "coverageId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "coverageId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "coverageId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "subscriptions", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/notification-subscriptions/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List support notification subscriptions for one or all customer organizations.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "create_subscription", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/notification-subscriptions/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create an explicit event and recipient subscription; only configured supported delivery channels are accepted.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "eventType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "recipientType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "recipientId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "channel": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "customerOrganizationId", + "recipientId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "update_subscription", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/notification-subscriptions/{subscriptionId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update or disable one support notification subscription.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "subscriptionId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "subscriptionId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "eventType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "recipientType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "recipientId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "channel": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "customerOrganizationId", + "recipientId" + ] + } + }, + "required": [ + "subscriptionId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "delete_subscription", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/notification-subscriptions/{subscriptionId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete one support notification subscription.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "subscriptionId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "subscriptionId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "subscriptionId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "my_preferences", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/support/notification-preferences/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the authenticated caller\u0027s own support notification preferences.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "NotificationAccess for the authenticated caller; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_support", + "operation": "set_my_preference", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/notification-preferences/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update one of the authenticated caller\u0027s preferences; the server selects the caller identity.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "NotificationAccess for the authenticated caller; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "eventType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "channel": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "user_preferences", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/users/{userId}/notification-preferences/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read one selected user\u0027s notification preferences under administrator authority.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "set_user_preference", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/users/{userId}/notification-preferences/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update a selected user\u0027s preference under administrator authority; the route determines the target user.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "userId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "eventType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "channel": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [] + } + }, + "required": [ + "userId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "recipient_preview", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/organizations/{organizationId}/recipient-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Resolve the actual recipients for one organization event without sending mail.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "eventType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "eventType", + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_support", + "operation": "bootstrap_defaults", + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/support/bootstrap/defaults", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Ensure the instance\u0027s default support configuration using the canonical idempotent bootstrapper.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_sla", + "operation": "policies", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/slas/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read SLA policies and escalation rules.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_sla", + "operation": "create_policy", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/slas/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create an SLA policy with its scope, matching rules, deadlines and escalations.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "appliesTo": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "priority": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "serviceId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "matchRank": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "responseTimeHours": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "resolutionTimeHours": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "autoResumeAfterHours": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "isActive": { + "type": "boolean" + }, + "escalations": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "metric": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "triggerPercent": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "recipients": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "targets": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "value": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [] + } + }, + "isActive": { + "type": "boolean" + }, + "note": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + } + }, + "required": [ + "name" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "update_policy", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/slas/{policyId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update an existing SLA policy using canonical validation and audit events.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "policyId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "policyId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "appliesTo": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "priority": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "serviceId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "matchRank": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "responseTimeHours": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "resolutionTimeHours": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "autoResumeAfterHours": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "isActive": { + "type": "boolean" + }, + "escalations": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "metric": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "triggerPercent": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "recipients": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "targets": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "value": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [] + } + }, + "isActive": { + "type": "boolean" + }, + "note": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + } + }, + "required": [ + "name" + ] + } + }, + "required": [ + "policyId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "delete_policy", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/slas/{policyId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete a selected SLA policy.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "policyId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "policyId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "policyId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "calendars", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/sla-calendars/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read business calendars, weekly hours and date exceptions.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_sla", + "operation": "create_calendar", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/sla-calendars/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create a validated business-hours calendar.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "timeZoneId": { + "type": "string", + "maxLength": 262144 + }, + "weeklyRules": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "dayOfWeek": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "isWorkingDay": { + "type": "boolean" + }, + "workingHours": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "start": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "end": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + } + }, + "required": [] + } + } + }, + "required": [] + } + }, + "exceptions": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "date": { + "type": "string", + "format": "date" + }, + "isWorkingDayOverride": { + "type": "boolean" + }, + "workingHoursOverride": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "start": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "end": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + } + }, + "required": [] + } + }, + "note": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + }, + "isActive": { + "type": "boolean" + } + }, + "required": [ + "name", + "timeZoneId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "update_calendar", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/sla-calendars/{calendarId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update calendar rules and exceptions.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "calendarId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "calendarId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "timeZoneId": { + "type": "string", + "maxLength": 262144 + }, + "weeklyRules": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "dayOfWeek": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "isWorkingDay": { + "type": "boolean" + }, + "workingHours": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "start": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "end": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + } + }, + "required": [] + } + } + }, + "required": [] + } + }, + "exceptions": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "date": { + "type": "string", + "format": "date" + }, + "isWorkingDayOverride": { + "type": "boolean" + }, + "workingHoursOverride": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "start": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "end": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + } + }, + "required": [] + } + }, + "note": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + }, + "isActive": { + "type": "boolean" + } + }, + "required": [ + "name", + "timeZoneId" + ] + } + }, + "required": [ + "calendarId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "delete_calendar", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/sla-calendars/{calendarId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete a selected calendar subject to canonical usage constraints.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "calendarId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "calendarId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "calendarId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "tenant_settings", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-sla-settings/{tenantId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read one tenant\u0027s business-hours and calendar selection.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "tenantId", + "type": "string", + "source": "Tenant SLA settings use the string organization identifier from the authorized organization list" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "tenantId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "save_tenant_settings", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenant-sla-settings/{tenantId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Save the selected tenant\u0027s business-hours and calendar settings.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "tenantId", + "type": "string", + "source": "Tenant SLA settings use the string organization identifier from the authorized organization list" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": "string", + "maxLength": 262144 + }, + "useBusinessHours": { + "type": "boolean" + }, + "calendarId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [ + "useBusinessHours" + ] + } + }, + "required": [ + "tenantId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "report_subscriptions", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/sla-report-subscriptions/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read scheduled SLA reports and recipients.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_sla", + "operation": "create_report_subscription", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/sla-report-subscriptions/", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create an SLA report schedule with explicit recipients and tenant scope.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "tenantId": { + "type": "string", + "maxLength": 262144 + }, + "isActive": { + "type": "boolean" + }, + "frequency": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "weeklyDay": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "sendTimeLocal": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "timeZoneId": { + "type": "string", + "maxLength": 262144 + }, + "targets": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "value": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [] + } + }, + "lookbackDays": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "includeCsvAttachment": { + "type": "boolean" + }, + "includeExcelAttachment": { + "type": "boolean" + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + }, + "serviceId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [ + "tenantId", + "frequency", + "sendTimeLocal", + "timeZoneId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "update_report_subscription", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/sla-report-subscriptions/{subscriptionId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update or disable an SLA report schedule.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "subscriptionId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "subscriptionId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "tenantId": { + "type": "string", + "maxLength": 262144 + }, + "isActive": { + "type": "boolean" + }, + "frequency": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "weeklyDay": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "sendTimeLocal": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "timeZoneId": { + "type": "string", + "maxLength": 262144 + }, + "targets": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "value": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [] + } + }, + "lookbackDays": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "includeCsvAttachment": { + "type": "boolean" + }, + "includeExcelAttachment": { + "type": "boolean" + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + }, + "serviceId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [ + "tenantId", + "frequency", + "sendTimeLocal", + "timeZoneId" + ] + } + }, + "required": [ + "subscriptionId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "delete_report_subscription", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/sla-report-subscriptions/{subscriptionId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Remove one SLA report schedule.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "subscriptionId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "subscriptionId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "subscriptionId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "compliance", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/compliance", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read SLA compliance for a declared period and ticket type.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "fromUtc": { + "type": "string", + "format": "date-time", + "minLength": 1, + "pattern": "\\S" + }, + "toUtc": { + "type": "string", + "format": "date-time", + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + } + }, + "required": [ + "fromUtc", + "toUtc" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "breached", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/breached", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read a page of breached open tickets.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 100000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + } + }, + "required": [ + "page", + "pageSize" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "near_breach", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/near-breach", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read a page of tickets approaching the selected SLA threshold.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 100000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "thresholdPercent": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "metric": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + } + }, + "required": [ + "page", + "pageSize", + "thresholdPercent", + "metric" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "completed", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/completed", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read completed ticket SLA outcomes for a declared period.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "fromUtc": { + "type": "string", + "format": "date-time", + "minLength": 1, + "pattern": "\\S" + }, + "toUtc": { + "type": "string", + "format": "date-time", + "minLength": 1, + "pattern": "\\S" + }, + "page": { + "type": "integer", + "minimum": 1, + "maximum": 100000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + }, + "withinResolutionSla": { + "type": [ + "boolean", + "null" + ] + } + }, + "required": [ + "fromUtc", + "toUtc", + "page", + "pageSize" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "pause_ticket", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/sla/pause", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Pause one eligible ticket SLA with a recorded reason; parent ticket authorization is enforced.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Parent ticket manager authority; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "reason": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "reason" + ] + } + }, + "required": [ + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_sla", + "operation": "resume_ticket", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/sla/resume", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Resume one eligible ticket SLA through its canonical lifecycle.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Parent ticket manager authority; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [] + } + }, + "required": [ + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "list", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List datasets in the explicitly selected authorized organization.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "get", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read an authorized dataset definition and schema.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "datasetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "datasetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "create", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create a dataset with typed columns and explicit organization scope. Non-administrators remain restricted to custom sources.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "name": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "sourceType": { + "type": "integer", + "enum": [ + 0, + 1, + 2, + 3, + 4 + ] + }, + "keyColumn": { + "type": "string", + "maxLength": 262144 + }, + "displayColumn": { + "type": "string", + "maxLength": 262144 + }, + "searchColumns": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "isActive": { + "type": "boolean" + }, + "columns": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "dataType": { + "type": "integer", + "enum": [ + 0, + 1, + 2, + 3 + ] + }, + "isKey": { + "type": "boolean" + }, + "isDisplay": { + "type": "boolean" + }, + "isSearchable": { + "type": "boolean" + }, + "sortOrder": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [] + } + } + }, + "required": [ + "organizationId", + "name" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "update", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update a dataset definition within its actual stored organization scope.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "datasetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "sourceType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + 3, + 4, + null + ] + }, + "keyColumn": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "displayColumn": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "searchColumns": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "isActive": { + "type": [ + "boolean", + "null" + ] + }, + "columns": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "dataType": { + "type": "integer", + "enum": [ + 0, + 1, + 2, + 3 + ] + }, + "isKey": { + "type": "boolean" + }, + "isDisplay": { + "type": "boolean" + }, + "isSearchable": { + "type": "boolean" + }, + "sortOrder": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [] + } + } + }, + "required": [] + } + }, + "required": [ + "datasetId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "delete", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete one authorized dataset through the canonical service.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "datasetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "datasetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "rows", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/rows", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read bounded, searchable dataset rows.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "datasetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 500 + }, + "page": { + "type": "integer", + "minimum": 1, + "maximum": 100000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "page", + "pageSize", + "datasetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "upsert_rows", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/rows", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Update up to 100 dataset rows using the authenticated operator\u0027s actual organization authority. Set deleteMissing explicitly; true removes existing rows omitted from this selected update. The separate ingestion API-key contract remains unchanged.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "datasetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "deleteMissing": { + "type": "boolean" + }, + "rows": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "externalKey": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "data": { + "type": "object", + "maxProperties": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + } + } + } + }, + "x-maxUtf8Bytes": 65536, + "description": "User-defined JSON columns, at most 100 keys and 64 KiB after compact wire serialization, with bounded nesting. Keys identify dataset columns, not API routes." + }, + "sourceUpdatedAtUtc": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "externalKey", + "data" + ] + } + } + }, + "required": [ + "rows", + "deleteMissing" + ], + "x-maxUtf8Bytes": 1048576, + "description": "At most 1 MiB of compact JSON after wire serialization; at most 100 rows. deleteMissing must be explicit: false changes only submitted rows, true is a complete replacement." + } + }, + "required": [ + "datasetId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "credentials", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/credentials", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read dataset ingestion credential metadata without secret keys.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "datasetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "datasetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "create_credential", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/credentials", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create one dataset ingestion credential. Its plaintext key is returned once to this authenticated creation request; subsequent credential reads return metadata only.", + "sensitiveResultFields": [ + "plainTextKey" + ], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "datasetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [ + "name" + ] + } + }, + "required": [ + "datasetId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "revoke_credential", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/credentials/{credentialId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Revoke one ingestion credential under the dataset\u0027s API-management authority.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "datasetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "credentialId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "credentialId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "datasetId", + "credentialId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "graph_settings", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/graph-settings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read Graph dataset configuration and synchronization diagnostics without stored secrets.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "save_graph_settings", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/resources/datasets/graph-settings", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Save Graph dataset configuration, a write-only client secret and schedule controls. Omit or leave clientSecret empty to preserve its existing protected value.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "clientId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "clientSecret": { + "type": [ + "string", + "null" + ], + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "enableUsers": { + "type": "boolean" + }, + "enableDevices": { + "type": "boolean" + }, + "enableGroups": { + "type": "boolean" + }, + "enableSharePointSites": { + "type": "boolean" + }, + "backgroundSyncEnabled": { + "type": "boolean" + }, + "backgroundSyncCronExpression": { + "type": "string", + "maxLength": 100 + } + }, + "required": [ + "organizationId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "sync_graph", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/graph-settings/{organizationId}/sync", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Synchronize enabled built-in datasets through the saved Graph integration.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "organizationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "options", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/datasets/{datasetId}/options", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read authorized searchable dataset options for self-service form inputs.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User in the dataset organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "datasetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 500 + }, + "page": { + "type": "integer", + "minimum": 1, + "maximum": 100000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 50 + }, + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "page", + "pageSize", + "datasetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "webhook_configurations", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List AI webhook configurations for one explicit organization, including enabled/archived state and signing-secret availability; stored secrets remain write-only.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "create_webhook", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create an organization-bound AI assistance webhook with numeric ticket areas (0 incidents, 1 requests, 2 changes). The API validates the configured endpoint; no investigation is dispatched by saving settings.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "ticketAreas": { + "type": "array", + "maxItems": 3, + "items": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "minItems": 1 + }, + "endpoint": { + "type": "string", + "maxLength": 2048, + "minLength": 1, + "pattern": "\\S" + }, + "routeName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "promptTemplate": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "permittedInputsSchemaJson": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "timeoutSeconds": { + "type": "integer", + "minimum": 1, + "maximum": 120 + }, + "maxBodyBytes": { + "type": "integer", + "minimum": 1024, + "maximum": 262144 + }, + "signingSecret": { + "type": [ + "string", + "null" + ], + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "organizationId", + "name", + "ticketAreas", + "endpoint" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "update_webhook", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/{webhookId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Replace the selected AI webhook configuration within its explicit organization. Omit signingSecret or supply an empty value to preserve it; a supplied nonempty secret rotates it without readback.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "webhookId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "webhookId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "ticketAreas": { + "type": "array", + "maxItems": 3, + "items": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "minItems": 1 + }, + "endpoint": { + "type": "string", + "maxLength": 2048, + "minLength": 1, + "pattern": "\\S" + }, + "routeName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "promptTemplate": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "permittedInputsSchemaJson": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "timeoutSeconds": { + "type": "integer", + "minimum": 1, + "maximum": 120 + }, + "maxBodyBytes": { + "type": "integer", + "minimum": 1024, + "maximum": 262144 + }, + "signingSecret": { + "type": [ + "string", + "null" + ], + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "organizationId", + "name", + "ticketAreas", + "endpoint" + ] + } + }, + "required": [ + "webhookId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "set_webhook_state", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/{webhookId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Enable, disable, archive or restore an organization-bound AI webhook configuration with an attributed administrative audit.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "webhookId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "webhookId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "enabled": { + "type": "boolean" + }, + "archived": { + "type": "boolean" + } + }, + "required": [ + "organizationId", + "enabled", + "archived" + ] + } + }, + "required": [ + "webhookId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "eligible_configurations", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/eligible-configurations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List active AI webhook configurations eligible for this incident, request or change and its actual organization.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "dispatch_investigation", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/investigations", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Dispatch one AI investigation using a saved eligible configuration and an explicit operator assistance request. Keep the same idempotencyKey for retries of this exact ticket, configuration and request; read investigation_worklog before retrying an uncertain result.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "configurationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "operatorAssistanceRequest": { + "type": "string", + "maxLength": 16000, + "minLength": 1, + "pattern": "\\S" + }, + "idempotencyKey": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "configurationId", + "operatorAssistanceRequest", + "idempotencyKey" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "investigation_worklog", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/worklog", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read persisted investigation identities, correlation IDs, progress and outcomes for this ticket. This snapshot provides the worklog evidence also shown by the UI stream.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_capabilities", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat-capabilities", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read native chat availability and its actual disabled reason. SQLite or deployment-disabled native chat is an unavailable capability, not a successful chat campaign.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_open", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Open the current native conversation, creating the first one when absent. This canonical GET can persist a conversation, so the MCP operation requires explicit confirmation. Read chat_capabilities first.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read at most 200 durable events after cursor from an explicit existing conversation without creating one. Use its returned lastSequence and event sequence values to read remaining pages.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "cursor": { + "type": [ + "integer", + "null" + ], + "minimum": 0, + "maximum": 9223372036854775807 + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "conversationId", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_history", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/history", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List up to 50 native conversations for this ticket, active first, with skip for older pages. Provider credentials and session paths are excluded.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "skip": { + "type": [ + "integer", + "null" + ], + "minimum": 0, + "maximum": 2147483647 + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_send", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/messages", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Submit one native chat message with a stable clientMessageId. Retry only the exact same text and identity; if delivery is uncertain, inspect chat and use chat_reconcile without resending.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "clientMessageId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "text": { + "type": "string", + "maxLength": 16000, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "conversationId", + "clientMessageId", + "text" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_respond", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/interactions/{callId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Select one exact offered option for the current interaction. Conversation, call ID, option and current awaiting-approval state remain enforced by the canonical API.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "callId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "callId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "selectedKey": { + "type": "string", + "maxLength": 1024, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "conversationId", + "selectedKey" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "callId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_reconcile", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/reconcile", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Request conservative recovery of an unresolved native turn using the saved provider session. This never resends the operator message.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [ + "conversationId" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_stop_waiting", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/stop-waiting", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Stop waiting for the explicitly identified uncertain turn and retire its local transport owner. This records uncertainty and never claims remote cancellation or resends the message.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "expectedMessageId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [ + "conversationId", + "expectedMessageId" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_abandon", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/abandon", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Abandon unresolved delivery using stable resolutionId and expectedMessageId with explicit acknowledgement that the previous remote turn may still execute. The canonical API audits and serializes this resolution.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "resolutionId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "expectedMessageId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "acknowledgePossibleDelivery": { + "type": "boolean", + "enum": [ + true + ] + } + }, + "required": [ + "conversationId", + "resolutionId", + "expectedMessageId", + "acknowledgePossibleDelivery" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_new", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/new", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Archive the selected idle conversation and open a blank one. Active or unresolved turns must first complete or use the explicit recovery/abandon lifecycle.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [ + "conversationId" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "rules", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/automation/rules/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List saved automation rules with their trigger, conditions and actions.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_automation", + "operation": "get_rule", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/automation/rules/{ruleId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read one saved automation rule before editing or deleting it.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ruleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "create_rule", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/automation/rules/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create an automation rule through the same canonical API as the administration screen. Conditions and actions retain the API\u0027s text representation; this operation saves the rule and does not claim a provider execution.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "trigger": { + "type": "string", + "maxLength": 1000, + "minLength": 1, + "pattern": "\\S" + }, + "conditions": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "actions": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + } + }, + "required": [ + "name", + "trigger" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "update_rule", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/automation/rules/{ruleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Replace the selected rule\u0027s name, trigger, conditions and actions. Read the current rule first; explicitly supply null conditions/actions to clear them. The route determines the stored identifier.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ruleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "trigger": { + "type": "string", + "maxLength": 1000, + "minLength": 1, + "pattern": "\\S" + }, + "conditions": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "actions": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + } + }, + "required": [ + "name", + "trigger", + "conditions", + "actions" + ] + } + }, + "required": [ + "ruleId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_automation", + "operation": "delete_rule", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/automation/rules/{ruleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete exactly one selected automation rule.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ruleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "assets", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/assets/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List asset records visible to the authorized instance administrator.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "get_asset", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/assets/{assetId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the selected asset and its saved organization before editing.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "assetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "assetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "assetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "create_asset", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/assets/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Create an asset with an explicit organization identifier and bounded inventory fields. An explicit empty organizationId preserves the canonical unassigned asset behavior. The API assigns its identifier.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "organizationId": { + "type": "string", + "maxLength": 128 + }, + "type": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "manufacturer": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "model": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "serialNumber": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "notes": { + "type": [ + "string", + "null" + ], + "maxLength": 32768 + } + }, + "required": [ + "name", + "organizationId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "update_asset", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/assets/{assetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Replace the selected asset\u0027s inventory fields and organization. Read current values first; supply all optional fields explicitly, using null only to clear them. The route determines the stored identifier.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "assetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "assetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "organizationId": { + "type": "string", + "maxLength": 128 + }, + "type": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "manufacturer": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "model": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "serialNumber": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "notes": { + "type": [ + "string", + "null" + ], + "maxLength": 32768 + } + }, + "required": [ + "name", + "organizationId", + "type", + "manufacturer", + "model", + "serialNumber", + "notes" + ] + } + }, + "required": [ + "assetId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "delete_asset", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/assets/{assetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete exactly one selected asset through the canonical administrator endpoint.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "assetId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "assetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "assetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "instance_branding", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/branding/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read effective instance branding, persisted values, defaults and each field\u0027s source/editability. Deployment-owned values remain authoritative.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "update_instance_branding", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/branding/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Save all instance branding fields after reading their current values and editability. Explicit null or blank resets an editable field to its configured default. The canonical provider preserves deployment-owned values and validates web/image URLs.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "applicationName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "organizationName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "applicationUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "organizationUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "supportUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "supportEmail": { + "type": [ + "string", + "null" + ], + "maxLength": 320 + }, + "logoUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "compactLogoUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "faviconUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "emailFromDisplayName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "tagline": { + "type": [ + "string", + "null" + ], + "maxLength": 2000 + } + }, + "required": [ + "applicationName", + "organizationName", + "applicationUrl", + "organizationUrl", + "supportUrl", + "supportEmail", + "logoUrl", + "compactLogoUrl", + "faviconUrl", + "emailFromDisplayName", + "tagline" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "tenant_branding", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenants/{brandingTenantId}/branding", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read saved or default email branding for the canonical positive integer branding tenant identifier; organization and SLA identifiers remain separate string selectors.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "brandingTenantId", + "type": "integer", + "source": "helpdesk_organizations.tenants or tenant_lookup: positive integer tenant identifier; never an organizationId" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "brandingTenantId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + } + }, + "required": [ + "brandingTenantId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "upload_branding_logo", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tenants/{brandingTenantId}/branding/logo", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Upload one image logo of at most 1 MiB through the canonical multipart file endpoint, then read tenant branding to verify the stored logo URL. Use the positive integer branding tenant identifier.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "brandingTenantId", + "type": "integer", + "source": "helpdesk_organizations.tenants or tenant_lookup: positive integer tenant identifier; never an organizationId" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "brandingTenantId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "fileName": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "pattern": "^(?!\\.{1,2}$)[^/\\\\\\u0000-\\u001F\\u007F-\\u009F]\u002B$", + "examples": [ + "fixture.png" + ] + }, + "contentType": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "^image/[A-Za-z0-9!#$\u0026^_.\u002B-]\u002B$", + "examples": [ + "image/png" + ] + }, + "contentBase64": { + "type": "string", + "maxLength": 1398104, + "minLength": 1, + "pattern": "^(?:[A-Za-z0-9\u002B/]{4})*(?:[A-Za-z0-9\u002B/]{2}==|[A-Za-z0-9\u002B/]{3}=)?$", + "examples": [ + "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + ], + "description": "Base64 file bytes, 1 byte through 1 MiB after decoding. No data-URL prefix or embedded whitespace." + } + }, + "required": [ + "fileName", + "contentType", + "contentBase64" + ] + } + }, + "required": [ + "brandingTenantId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "background_worker_settings", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/ops/hangfire/settings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read saved background-worker enablement, actual queue/storage runtime and recurring/Graph synchronization job counts.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "update_background_worker_settings", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/ops/hangfire/settings", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Explicitly enable or disable background processing through the runtime administration service, which reconciles Graph dataset schedules. Inspect pending work before disabling, and verify the resulting settings and job counts.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "enabled": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "my_credentials", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/integration-credentials/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List the authenticated owner\u0027s integration credential metadata, scopes, expiry and revocation state. Never returns credential secrets or another owner\u0027s records; creating additional account credentials retains its separate interactive consent boundary.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "revoke_my_credential", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/integration-credentials/{credentialId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Revoke one of the authenticated owner\u0027s credentials. Existing cached execution tokens are invalidated by current credential checks. A credential owned by another account remains inaccessible.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "credentialId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "credentialId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "credentialId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "delete_my_credential_record", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/integration-credentials/{credentialId}/record", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Revoke and permanently remove one of the authenticated owner\u0027s credential records through the canonical lifecycle. Read owned metadata first and preserve any required audit evidence before confirmation.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "credentialId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "credentialId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "credentialId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "incident_sources", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/integrations/netratel/sources/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "List the configured incident receiver source namespaces, organization/customer targets, enabled state and revision.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_connections", + "operation": "register_incident_source", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/integrations/netratel/sources/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Register a NetRatel source instance against an enabled organization/customer and an existing valid API-purpose credential. The API validates that credential\u0027s owner, organization, purpose, expiry and revocation; this operation does not issue a new credential.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "sourceInstanceId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "customerId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "credentialId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "sourceInstanceId", + "organizationId", + "customerId", + "credentialId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "set_incident_source_state", + "requestContract": "OperatorRequest", + "method": "PATCH", + "pathTemplate": "/api/v1/integrations/netratel/sources/{namespaceId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Enable or disable a registered incident source at its currently read expectedRevision. Concurrent changes return conflict; read the source again before a reviewed update.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "namespaceId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "namespaceId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedRevision": { + "type": "integer", + "minimum": 1, + "maximum": 9223372036854775807 + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "expectedRevision", + "isEnabled" + ] + } + }, + "required": [ + "namespaceId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_connections", + "operation": "set_incident_source_credential", + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/integrations/netratel/sources/{namespaceId}/principal-bindings/{credentialId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Enable or disable an explicitly selected API credential binding for a source namespace at its current expectedRevision. The API verifies active credentials belong to the source organization and persists the source audit.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "namespaceId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "credentialId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "credentialId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "namespaceId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedRevision": { + "type": "integer", + "minimum": 1, + "maximum": 9223372036854775807 + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "expectedRevision", + "isEnabled" + ] + } + }, + "required": [ + "credentialId", + "namespaceId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "organization_options", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the enabled organizations available in the caller\u0027s ticket creation and editing interface.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current ticket module permissions and enabled organizations; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "module": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incident", + "request", + "change" + ], + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "module" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "customer_options", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/customers", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read enabled customer choices for one authorized organization and ticket module.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current module and organization authority; own-customer scope for non-managers; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture.", + "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "module": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incident", + "request", + "change" + ], + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "organizationId", + "module" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "search_assignees", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/assignees/search", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Search bounded eligible assignees, including saved external support coverage. Use the returned eligible identity in confirmed assignment actions.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Manager of the selected ticket module and organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "limit": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 50 + }, + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "module": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incident", + "request", + "change" + ], + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "organizationId", + "module" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "current_assignee", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/assignees/current", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Resolve an existing ticket assignment, including a retained user who is no longer eligible for a new assignment.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Visibility of the selected ticket and matching organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "module": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incident", + "request", + "change" + ], + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "ticketId", + "organizationId", + "module" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "filter_options", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/filter-options", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Search authorized organization, requested-for and assignee labels for ticket filters. selectedId and customerOrgId are bounded repeated query values.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Current module ticket visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "dimension": { + "type": "string", + "maxLength": 262144, + "enum": [ + "customer", + "for", + "assignee" + ], + "minLength": 1, + "pattern": "\\S" + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "take": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 50 + }, + "customerOrgId": { + "type": [ + "array", + "null" + ], + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1, + "maxLength": 200, + "pattern": "\\S" + } + }, + "selectedId": { + "type": [ + "array", + "null" + ], + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1, + "maxLength": 200, + "pattern": "\\S" + } + }, + "module": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incident", + "request", + "change" + ], + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "dimension", + "module" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "set_customer", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/customer", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Set a requester only on a ticket without one, using an enabled customer in the same organization. Read the ticket afterward to verify the saved requester.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Manager of the parent ticket\u0027s organization and module; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ticketType", + "type": "string", + "source": "incidents, requests, or changes" + }, + { + "field": "ticketId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "customerId" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "incident_activity", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/activity", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the persisted incident activity audit, independently of the rendered timeline.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Parent incident visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "incidentId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "request_worklogs", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/worklogs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read authorized request worklog records and their stored effort.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Parent request visibility; internal notes require staff scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "requestId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "self_service_tasks", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/requests/{requestId}/tasks", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read task progress through the same owned-request and released-form audience rules as the self-service interface.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User and current customer/form audience, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "requestId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "requestId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_changes", + "operation": "my_approval", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/approval/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the caller\u0027s designated change approval. An owner cannot substitute another approver\u0027s identity.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Stored designated approver identity and current change visibility or approval authority; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "changeId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_changes", + "operation": "review_approval", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/approval/review", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Review and approve the caller\u0027s own pending change approval. The last required review advances the change to ApprovedForImplementation and queues its timeline and notifications. Signed and authenticated decisions serialize together; a repeated committed review adds no duplicate effects. On 409 read my_approval before another action.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Stored designated approver identity and current change visibility or approval authority; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "changeId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow.", + "Authorized organization/participants, valid type-specific change template and implementation window; approval, draft edit lock, implementation and closure invariants remain enforced." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "changeId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "dashboard", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/dashboard/admin-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read live administrative incident, request and change dashboard metrics.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "technician_dashboard", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/dashboard/technician-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the authenticated technician\u0027s authorized open ticket counts.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "HelpdeskStaff; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "customer_dashboard", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/dashboard/customer-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the current linked customer\u0027s ticket summary. An account with no linked customer receives the canonical empty summary.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "SelfService.User; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture.", + "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "online_users", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/presence/online-users", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read identities currently connected to the platform\u0027s presence service.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_notifications", + "operation": "unread", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/unread", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read one bounded page of the caller\u0027s unread notifications.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "NotificationAccess and current recipient visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 1000000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "error_summary", + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/notifications/error-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the caller\u0027s authorized error notification counters.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "NotificationAccess and current recipient visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": null + }, + { + "tool": "helpdesk_notifications", + "operation": "timeline", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read persisted DomainEvent notifications for a reference, correlationId or both, with bounded output. At least one selector must contain non-whitespace text.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "NotificationAccess and current recipient/organization visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "reference": { + "type": [ + "string", + "null" + ], + "maxLength": 128 + }, + "correlationId": { + "type": [ + "string", + "null" + ], + "maxLength": 128 + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 128 + }, + "take": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 200 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body.", + "anyOf": [ + { + "required": [ + "reference" + ], + "properties": { + "reference": { + "type": "string", + "minLength": 1, + "pattern": "\\S" + } + } + }, + { + "required": [ + "correlationId" + ], + "properties": { + "correlationId": { + "type": "string", + "minLength": 1, + "pattern": "\\S" + } + } + } + ] + } + }, + { + "tool": "helpdesk_incidents", + "operation": "relations", + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/relations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "previewSupported": false, + "description": "Read the current incident\u0027s duplicate and related links. Links to incidents outside the caller\u0027s visibility are excluded.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Visibility of both related incidents; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Read current authorized records; empty results do not prove a positive lifecycle fixture." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "incidentId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "create_relation", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/relations", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Link two incidents in the same organization and copy source listeners to the target. relationType 0 means DuplicateOf and always resolves the source; 1 means RelatedTo and follows the explicit closeSourceTicket choice. Closing completes the source SLA and publishes the canonical event. Read both incidents and relations after an uncertain result before another attempt; an existing identical relation returns 409.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident.Manager in both incident organizations or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "targetTicketId": { + "type": "string", + "maxLength": 128, + "pattern": ".*\\S.*", + "minLength": 1 + }, + "relationType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "closeSourceTicket": { + "type": "boolean" + }, + "note": { + "type": [ + "string", + "null" + ], + "maxLength": 4000 + } + }, + "required": [ + "targetTicketId", + "relationType", + "closeSourceTicket" + ] + } + }, + "required": [ + "incidentId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "delete_relation", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/incidents/{incidentId}/relations/{relationId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Remove the selected relationship after reading its UUID. This removes only the link; it does not reopen the source or remove listeners already copied to the target.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident.Manager for both related incidents or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "incidentId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + }, + { + "field": "relationId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "relationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "incidentId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "relationId", + "incidentId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "bulk_delete", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/delete", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Permanently delete 1\u2013100 explicitly selected incidents through the canonical silent deletion action. Requesters are not notified. Check deleted and missing counts and read back the selected IDs before repeating an uncertain batch.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident deletion authority for every selected incident; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "minLength": 1, + "maxLength": 128, + "pattern": "\\S" + }, + "minItems": 1 + } + }, + "required": [ + "ids" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "bulk_marketing_spam", + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/marketing-spam", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Silently resolve 1\u2013100 explicitly selected incidents, complete their SLA, and exclude them from requester outbound email as marketing or spam. Check updated and missing counts and read back the selected incidents.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "available_subject_to_identity_permission_scope_and_prerequisites" + }, + "credentialModes": [ + "api-purpose account-bound credential (stdio)", + "mcp-purpose resource-bound credential with request-scoped API execution token (HTTP gateway)", + "explicit external Authentik identity" + ], + "authority": "Incident.Manager for every selected incident or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "minLength": 1, + "maxLength": 128, + "pattern": "\\S" + }, + "minItems": 1 + } + }, + "required": [ + "ids" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + } + ], + "schemaExamples": [ + { + "tool": "helpdesk_auth", + "operation": "status", + "examples": { + "schemaValidConfirmed": { + "operation": "status", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_auth", + "operation": "access", + "examples": { + "schemaValidConfirmed": { + "operation": "access", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_health", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_config", + "operation": "show", + "examples": { + "schemaValidConfirmed": { + "operation": "show", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_config", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "key": "apiBaseUrl" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "key": "apiBaseUrl" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_config", + "operation": "set", + "examples": { + "schemaValidConfirmed": { + "operation": "set", + "request": { + "key": "apiBaseUrl", + "value": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "set", + "request": { + "key": "apiBaseUrl", + "value": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "key": "apiBaseUrl", + "value": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_config", + "operation": "unset", + "examples": { + "schemaValidConfirmed": { + "operation": "unset", + "request": { + "key": "apiBaseUrl" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "unset", + "request": { + "key": "apiBaseUrl" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "key": "apiBaseUrl" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_capabilities", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_system", + "operation": "version", + "examples": { + "schemaValidConfirmed": { + "operation": "version", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_logs", + "operation": "search", + "examples": { + "schemaValidConfirmed": { + "operation": "search", + "request": { + "since": 0 + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "since": 0 + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "peek", + "examples": { + "schemaValidConfirmed": { + "operation": "peek", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "timeline", + "examples": { + "schemaValidConfirmed": { + "operation": "timeline", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "timeline_count", + "examples": { + "schemaValidConfirmed": { + "operation": "timeline_count", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "attachments_count", + "examples": { + "schemaValidConfirmed": { + "operation": "attachments_count", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "listeners_count", + "examples": { + "schemaValidConfirmed": { + "operation": "listeners_count", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "create", + "examples": { + "schemaValidConfirmed": { + "operation": "create", + "request": { + "title": "Example", + "description": "Example", + "organizationId": "Example", + "customerId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create", + "request": { + "title": "Example", + "description": "Example", + "organizationId": "Example", + "customerId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "title": "Example", + "description": "Example", + "organizationId": "Example", + "customerId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "bulk_create", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_create", + "request": { + "items": [ + { + "title": "Example", + "description": "Example", + "organizationId": "Example", + "customerId": "Example" + } + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_create", + "request": { + "items": [ + { + "title": "Example", + "description": "Example", + "organizationId": "Example", + "customerId": "Example" + } + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "items": [ + { + "title": "Example", + "description": "Example", + "organizationId": "Example", + "customerId": "Example" + } + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "update", + "examples": { + "schemaValidConfirmed": { + "operation": "update", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update", + "request": { + "incidentId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "delete", + "examples": { + "schemaValidConfirmed": { + "operation": "delete", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete", + "request": { + "incidentId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "state", + "examples": { + "schemaValidConfirmed": { + "operation": "state", + "request": { + "incidentId": "Example", + "newState": "New" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "state", + "request": { + "incidentId": "Example", + "newState": "New" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example", + "newState": "New" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "bulk_state", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_state", + "request": { + "newState": "New", + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_state", + "request": { + "newState": "New", + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "newState": "New", + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "assign", + "examples": { + "schemaValidConfirmed": { + "operation": "assign", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "assign", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "assign_self", + "examples": { + "schemaValidConfirmed": { + "operation": "assign_self", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "assign_self", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "add_worklog", + "examples": { + "schemaValidConfirmed": { + "operation": "add_worklog", + "request": { + "incidentId": "Example", + "hours": 0, + "notes": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "add_worklog", + "request": { + "incidentId": "Example", + "hours": 0, + "notes": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example", + "hours": 0, + "notes": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "close", + "examples": { + "schemaValidConfirmed": { + "operation": "close", + "request": { + "incidentId": "Example", + "closureNote": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "close", + "request": { + "incidentId": "Example", + "closureNote": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example", + "closureNote": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "tasks", + "examples": { + "schemaValidConfirmed": { + "operation": "tasks", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "timeline", + "examples": { + "schemaValidConfirmed": { + "operation": "timeline", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "timeline_count", + "examples": { + "schemaValidConfirmed": { + "operation": "timeline_count", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "attachments_count", + "examples": { + "schemaValidConfirmed": { + "operation": "attachments_count", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "listeners_count", + "examples": { + "schemaValidConfirmed": { + "operation": "listeners_count", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "create", + "examples": { + "schemaValidConfirmed": { + "operation": "create", + "request": { + "description": "Example", + "title": "Example", + "organizationId": "Example", + "customerId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create", + "request": { + "description": "Example", + "title": "Example", + "organizationId": "Example", + "customerId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "description": "Example", + "title": "Example", + "organizationId": "Example", + "customerId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "update", + "examples": { + "schemaValidConfirmed": { + "operation": "update", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update", + "request": { + "requestId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "delete", + "examples": { + "schemaValidConfirmed": { + "operation": "delete", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete", + "request": { + "requestId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "state", + "examples": { + "schemaValidConfirmed": { + "operation": "state", + "request": { + "requestId": "Example", + "newState": "New" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "state", + "request": { + "requestId": "Example", + "newState": "New" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example", + "newState": "New" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "add_worklog", + "examples": { + "schemaValidConfirmed": { + "operation": "add_worklog", + "request": { + "requestId": "Example", + "hours": 0, + "notes": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "add_worklog", + "request": { + "requestId": "Example", + "hours": 0, + "notes": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example", + "hours": 0, + "notes": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "timeline", + "examples": { + "schemaValidConfirmed": { + "operation": "timeline", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "worklogs", + "examples": { + "schemaValidConfirmed": { + "operation": "worklogs", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "timeline_count", + "examples": { + "schemaValidConfirmed": { + "operation": "timeline_count", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "attachments_count", + "examples": { + "schemaValidConfirmed": { + "operation": "attachments_count", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "listeners_count", + "examples": { + "schemaValidConfirmed": { + "operation": "listeners_count", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "create", + "examples": { + "schemaValidConfirmed": { + "operation": "create", + "request": { + "title": "Example", + "description": "Example", + "changeType": "Standard", + "changeTemplate": { + "scopeOfChange": "Example", + "affectedSystems": [ + "Example" + ], + "implementationSteps": [ + "Example" + ], + "validationSteps": [ + "Example" + ], + "rollbackPlan": "Example", + "isPreApproved": true, + "existingRunbookReference": "Example" + }, + "organizationId": "Example", + "requestedForUserId": "Example", + "implementorUserId": "Example", + "implementationStartAt": "2027-01-01T00:00:00Z", + "implementationEndAt": "2027-01-01T00:00:00Z" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create", + "request": { + "title": "Example", + "description": "Example", + "changeType": "Standard", + "changeTemplate": { + "scopeOfChange": "Example", + "affectedSystems": [ + "Example" + ], + "implementationSteps": [ + "Example" + ], + "validationSteps": [ + "Example" + ], + "rollbackPlan": "Example", + "isPreApproved": true, + "existingRunbookReference": "Example" + }, + "organizationId": "Example", + "requestedForUserId": "Example", + "implementorUserId": "Example", + "implementationStartAt": "2027-01-01T00:00:00Z", + "implementationEndAt": "2027-01-01T00:00:00Z" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "title": "Example", + "description": "Example", + "changeType": "Standard", + "changeTemplate": { + "scopeOfChange": "Example", + "affectedSystems": [ + "Example" + ], + "implementationSteps": [ + "Example" + ], + "validationSteps": [ + "Example" + ], + "rollbackPlan": "Example", + "isPreApproved": true, + "existingRunbookReference": "Example" + }, + "organizationId": "Example", + "requestedForUserId": "Example", + "implementorUserId": "Example", + "implementationStartAt": "2027-01-01T00:00:00Z", + "implementationEndAt": "2027-01-01T00:00:00Z" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "update", + "examples": { + "schemaValidConfirmed": { + "operation": "update", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update", + "request": { + "changeId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "delete", + "examples": { + "schemaValidConfirmed": { + "operation": "delete", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete", + "request": { + "changeId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "state", + "examples": { + "schemaValidConfirmed": { + "operation": "state", + "request": { + "changeId": "Example", + "newState": "New" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "state", + "request": { + "changeId": "Example", + "newState": "New" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example", + "newState": "New" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "add_worklog", + "examples": { + "schemaValidConfirmed": { + "operation": "add_worklog", + "request": { + "changeId": "Example", + "hours": 0, + "notes": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "add_worklog", + "request": { + "changeId": "Example", + "hours": 0, + "notes": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example", + "hours": 0, + "notes": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "lifecycle", + "examples": { + "schemaValidConfirmed": { + "operation": "lifecycle", + "request": { + "changeId": "Example", + "lifecycleState": "Draft" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "lifecycle", + "request": { + "changeId": "Example", + "lifecycleState": "Draft" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example", + "lifecycleState": "Draft" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "report", + "examples": { + "schemaValidConfirmed": { + "operation": "report", + "request": { + "invocationId": "00000000-0000-0000-0000-000000000001", + "eventId": "Example", + "ticketId": "Example", + "correlationId": "Example", + "message": "Example", + "ticketType": "incidents", + "status": "Queued" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "invocationId": "00000000-0000-0000-0000-000000000001", + "eventId": "Example", + "ticketId": "Example", + "correlationId": "Example", + "message": "Example", + "ticketType": "incidents", + "status": "Queued" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_forms", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "requestFormId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestFormId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_forms", + "operation": "by_service", + "examples": { + "schemaValidConfirmed": { + "operation": "by_service", + "request": { + "serviceId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "serviceId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "timeline_count", + "examples": { + "schemaValidConfirmed": { + "operation": "timeline_count", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "attachments_count", + "examples": { + "schemaValidConfirmed": { + "operation": "attachments_count", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "listeners_count", + "examples": { + "schemaValidConfirmed": { + "operation": "listeners_count", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "bulk_create", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_create", + "request": { + "items": [ + { + "description": "Example", + "title": "Example", + "organizationId": "Example", + "customerId": "Example" + } + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_create", + "request": { + "items": [ + { + "description": "Example", + "title": "Example", + "organizationId": "Example", + "customerId": "Example" + } + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "items": [ + { + "description": "Example", + "title": "Example", + "organizationId": "Example", + "customerId": "Example" + } + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "bulk_state", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_state", + "request": { + "newState": "New", + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_state", + "request": { + "newState": "New", + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "newState": "New", + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "assign", + "examples": { + "schemaValidConfirmed": { + "operation": "assign", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "assign", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_requests", + "operation": "assign_self", + "examples": { + "schemaValidConfirmed": { + "operation": "assign_self", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "assign_self", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "bulk_create", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_create", + "request": { + "items": [ + { + "title": "Example", + "description": "Example", + "changeType": "Standard", + "changeTemplate": { + "scopeOfChange": "Example", + "affectedSystems": [ + "Example" + ], + "implementationSteps": [ + "Example" + ], + "validationSteps": [ + "Example" + ], + "rollbackPlan": "Example", + "isPreApproved": true, + "existingRunbookReference": "Example" + }, + "organizationId": "Example", + "requestedForUserId": "Example", + "implementorUserId": "Example", + "implementationStartAt": "2027-01-01T00:00:00Z", + "implementationEndAt": "2027-01-01T00:00:00Z" + } + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_create", + "request": { + "items": [ + { + "title": "Example", + "description": "Example", + "changeType": "Standard", + "changeTemplate": { + "scopeOfChange": "Example", + "affectedSystems": [ + "Example" + ], + "implementationSteps": [ + "Example" + ], + "validationSteps": [ + "Example" + ], + "rollbackPlan": "Example", + "isPreApproved": true, + "existingRunbookReference": "Example" + }, + "organizationId": "Example", + "requestedForUserId": "Example", + "implementorUserId": "Example", + "implementationStartAt": "2027-01-01T00:00:00Z", + "implementationEndAt": "2027-01-01T00:00:00Z" + } + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "items": [ + { + "title": "Example", + "description": "Example", + "changeType": "Standard", + "changeTemplate": { + "scopeOfChange": "Example", + "affectedSystems": [ + "Example" + ], + "implementationSteps": [ + "Example" + ], + "validationSteps": [ + "Example" + ], + "rollbackPlan": "Example", + "isPreApproved": true, + "existingRunbookReference": "Example" + }, + "organizationId": "Example", + "requestedForUserId": "Example", + "implementorUserId": "Example", + "implementationStartAt": "2027-01-01T00:00:00Z", + "implementationEndAt": "2027-01-01T00:00:00Z" + } + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "bulk_state", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_state", + "request": { + "newState": "New", + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_state", + "request": { + "newState": "New", + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "newState": "New", + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "assign", + "examples": { + "schemaValidConfirmed": { + "operation": "assign", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "assign", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "assign_self", + "examples": { + "schemaValidConfirmed": { + "operation": "assign_self", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "assign_self", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "create", + "examples": { + "schemaValidConfirmed": { + "operation": "create", + "request": { + "title": "Example", + "description": "Example", + "requestId": "Example", + "organizationId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create", + "request": { + "title": "Example", + "description": "Example", + "requestId": "Example", + "organizationId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "title": "Example", + "description": "Example", + "requestId": "Example", + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "update", + "examples": { + "schemaValidConfirmed": { + "operation": "update", + "request": { + "taskId": "Example", + "title": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update", + "request": { + "taskId": "Example", + "title": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "taskId": "Example", + "title": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "delete", + "examples": { + "schemaValidConfirmed": { + "operation": "delete", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete", + "request": { + "taskId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "start", + "examples": { + "schemaValidConfirmed": { + "operation": "start", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "start", + "request": { + "taskId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "complete", + "examples": { + "schemaValidConfirmed": { + "operation": "complete", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "complete", + "request": { + "taskId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "fail", + "examples": { + "schemaValidConfirmed": { + "operation": "fail", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "fail", + "request": { + "taskId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "retry", + "examples": { + "schemaValidConfirmed": { + "operation": "retry", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "retry", + "request": { + "taskId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "bulk_start", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_start", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_start", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "bulk_complete", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_complete", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_complete", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_request_tasks", + "operation": "bulk_retry", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_retry", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_retry", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ids": [ + "Example" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_organizations", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_organizations", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_organizations", + "operation": "tenants", + "examples": { + "schemaValidConfirmed": { + "operation": "tenants", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_organizations", + "operation": "tenant_lookup", + "examples": { + "schemaValidConfirmed": { + "operation": "tenant_lookup", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_organizations", + "operation": "change_participants", + "examples": { + "schemaValidConfirmed": { + "operation": "change_participants", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_customers", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_customers", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_users", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_users", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_roles", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_roles", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "roleId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "roleId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_categories", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_customers", + "operation": "auth_status", + "examples": { + "schemaValidConfirmed": { + "operation": "auth_status", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_users", + "operation": "by_email", + "examples": { + "schemaValidConfirmed": { + "operation": "by_email", + "request": { + "email": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "email": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_search", + "operation": "users", + "examples": { + "schemaValidConfirmed": { + "operation": "users", + "request": { + "query": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "query": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_search", + "operation": "customers", + "examples": { + "schemaValidConfirmed": { + "operation": "customers", + "request": { + "query": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "query": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_search", + "operation": "organizations", + "examples": { + "schemaValidConfirmed": { + "operation": "organizations", + "request": { + "query": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "query": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "mark_as_seen", + "examples": { + "schemaValidConfirmed": { + "operation": "mark_as_seen", + "request": { + "ticketId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "mark_as_seen", + "request": { + "ticketId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_services", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_services", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "serviceId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "serviceId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_services", + "operation": "items", + "examples": { + "schemaValidConfirmed": { + "operation": "items", + "request": { + "serviceId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "serviceId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_services", + "operation": "search_items", + "examples": { + "schemaValidConfirmed": { + "operation": "search_items", + "request": { + "query": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "query": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_services", + "operation": "breadcrumb", + "examples": { + "schemaValidConfirmed": { + "operation": "breadcrumb", + "request": { + "serviceId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "serviceId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_self_service", + "operation": "requests", + "examples": { + "schemaValidConfirmed": { + "operation": "requests", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_self_service", + "operation": "request_users", + "examples": { + "schemaValidConfirmed": { + "operation": "request_users", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_self_service", + "operation": "get_request", + "examples": { + "schemaValidConfirmed": { + "operation": "get_request", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "notificationId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "notificationId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "summary", + "examples": { + "schemaValidConfirmed": { + "operation": "summary", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "unread_errors", + "examples": { + "schemaValidConfirmed": { + "operation": "unread_errors", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "mark_read", + "examples": { + "schemaValidConfirmed": { + "operation": "mark_read", + "request": { + "ids": [ + "00000000-0000-0000-0000-000000000001" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "mark_read", + "request": { + "ids": [ + "00000000-0000-0000-0000-000000000001" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ids": [ + "00000000-0000-0000-0000-000000000001" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration", + "examples": { + "schemaValidConfirmed": { + "operation": "orchestration", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration_jobs", + "examples": { + "schemaValidConfirmed": { + "operation": "orchestration_jobs", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration_tenants", + "examples": { + "schemaValidConfirmed": { + "operation": "orchestration_tenants", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration_request_definitions", + "examples": { + "schemaValidConfirmed": { + "operation": "orchestration_request_definitions", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration_bindings", + "examples": { + "schemaValidConfirmed": { + "operation": "orchestration_bindings", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connectivity", + "operation": "orchestration_test", + "examples": { + "schemaValidConfirmed": { + "operation": "orchestration_test", + "confirm": true + }, + "schemaValidPreview": { + "operation": "orchestration_test", + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_schema", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_enums", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_enums", + "operation": "ticket_state", + "examples": { + "schemaValidConfirmed": { + "operation": "ticket_state", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_enums", + "operation": "ticket_priority", + "examples": { + "schemaValidConfirmed": { + "operation": "ticket_priority", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_enums", + "operation": "request_task_status", + "examples": { + "schemaValidConfirmed": { + "operation": "request_task_status", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_enums", + "operation": "change_lifecycle_state", + "examples": { + "schemaValidConfirmed": { + "operation": "change_lifecycle_state", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_examples", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_raw", + "operation": "system_version", + "examples": { + "schemaValidConfirmed": { + "operation": "system_version", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_raw", + "operation": "get_incident", + "examples": { + "schemaValidConfirmed": { + "operation": "get_incident", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_raw", + "operation": "get_request", + "examples": { + "schemaValidConfirmed": { + "operation": "get_request", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_raw", + "operation": "get_change", + "examples": { + "schemaValidConfirmed": { + "operation": "get_change", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_organization", + "examples": { + "schemaValidConfirmed": { + "operation": "create_organization", + "request": { + "name": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_organization", + "request": { + "name": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "name": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_organization", + "examples": { + "schemaValidConfirmed": { + "operation": "update_organization", + "request": { + "organizationId": "Example", + "name": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_organization", + "request": { + "organizationId": "Example", + "name": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example", + "name": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_organization", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_organization", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_organization", + "request": { + "organizationId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_customer", + "examples": { + "schemaValidConfirmed": { + "operation": "create_customer", + "request": { + "name": "Example", + "email": "Example", + "organizationId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_customer", + "request": { + "name": "Example", + "email": "Example", + "organizationId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "name": "Example", + "email": "Example", + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_customer", + "examples": { + "schemaValidConfirmed": { + "operation": "update_customer", + "request": { + "customerId": "Example", + "name": "Example", + "email": "Example", + "organizationId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_customer", + "request": { + "customerId": "Example", + "name": "Example", + "email": "Example", + "organizationId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "customerId": "Example", + "name": "Example", + "email": "Example", + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_customer", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_customer", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_customer", + "request": { + "customerId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_user", + "examples": { + "schemaValidConfirmed": { + "operation": "create_user", + "request": { + "name": "Example", + "email": "Example", + "role": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_user", + "request": { + "name": "Example", + "email": "Example", + "role": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "name": "Example", + "email": "Example", + "role": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_user", + "examples": { + "schemaValidConfirmed": { + "operation": "update_user", + "request": { + "userId": "Example", + "name": "Example", + "email": "Example", + "role": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_user", + "request": { + "userId": "Example", + "name": "Example", + "email": "Example", + "role": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example", + "name": "Example", + "email": "Example", + "role": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_user", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_user", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_user", + "request": { + "userId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_category", + "examples": { + "schemaValidConfirmed": { + "operation": "create_category", + "request": { + "name": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_category", + "request": { + "name": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "name": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_category", + "examples": { + "schemaValidConfirmed": { + "operation": "update_category", + "request": { + "categoryId": "00000000-0000-0000-0000-000000000001", + "name": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_category", + "request": { + "categoryId": "00000000-0000-0000-0000-000000000001", + "name": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "categoryId": "00000000-0000-0000-0000-000000000001", + "name": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_category", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_category", + "request": { + "categoryId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_category", + "request": { + "categoryId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "categoryId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_service", + "examples": { + "schemaValidConfirmed": { + "operation": "create_service", + "request": { + "name": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_service", + "request": { + "name": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "name": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_service", + "examples": { + "schemaValidConfirmed": { + "operation": "update_service", + "request": { + "serviceId": "Example", + "name": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_service", + "request": { + "serviceId": "Example", + "name": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "serviceId": "Example", + "name": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_service", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_service", + "request": { + "serviceId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_service", + "request": { + "serviceId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "serviceId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_role", + "examples": { + "schemaValidConfirmed": { + "operation": "create_role", + "request": { + "name": "Example", + "permissions": [ + "SelfService.User" + ], + "ownerOrganizationId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_role", + "request": { + "name": "Example", + "permissions": [ + "SelfService.User" + ], + "ownerOrganizationId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "name": "Example", + "permissions": [ + "SelfService.User" + ], + "ownerOrganizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_role", + "examples": { + "schemaValidConfirmed": { + "operation": "update_role", + "request": { + "roleId": "Example", + "name": "Example", + "permissions": [ + "SelfService.User" + ] + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_role", + "request": { + "roleId": "Example", + "name": "Example", + "permissions": [ + "SelfService.User" + ] + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "roleId": "Example", + "name": "Example", + "permissions": [ + "SelfService.User" + ] + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_role", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_role", + "request": { + "roleId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_role", + "request": { + "roleId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "roleId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_request_form", + "examples": { + "schemaValidConfirmed": { + "operation": "create_request_form", + "request": { + "serviceId": "Example", + "title": "Example", + "jsonSchema": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_request_form", + "request": { + "serviceId": "Example", + "title": "Example", + "jsonSchema": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "serviceId": "Example", + "title": "Example", + "jsonSchema": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_service_request_form", + "examples": { + "schemaValidConfirmed": { + "operation": "create_service_request_form", + "request": { + "serviceId": "Example", + "title": "Example", + "jsonSchema": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_service_request_form", + "request": { + "serviceId": "Example", + "title": "Example", + "jsonSchema": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "serviceId": "Example", + "title": "Example", + "jsonSchema": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "provision_user", + "examples": { + "schemaValidConfirmed": { + "operation": "provision_user", + "confirm": true + }, + "schemaValidPreview": { + "operation": "provision_user", + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_organization_branding", + "examples": { + "schemaValidConfirmed": { + "operation": "update_organization_branding", + "request": { + "tenantId": 1 + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_organization_branding", + "request": { + "tenantId": 1 + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "tenantId": 1 + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "update_request_form", + "examples": { + "schemaValidConfirmed": { + "operation": "update_request_form", + "request": { + "requestFormId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_request_form", + "request": { + "requestFormId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestFormId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "delete_request_form", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_request_form", + "request": { + "requestFormId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_request_form", + "request": { + "requestFormId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestFormId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "create_self_service_request", + "examples": { + "schemaValidConfirmed": { + "operation": "create_self_service_request", + "request": { + "requestFormId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_self_service_request", + "request": { + "requestFormId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestFormId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "customer_invite", + "examples": { + "schemaValidConfirmed": { + "operation": "customer_invite", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "customer_invite", + "request": { + "customerId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "customer_resend_invite", + "examples": { + "schemaValidConfirmed": { + "operation": "customer_resend_invite", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "customer_resend_invite", + "request": { + "customerId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "customer_disable_login", + "examples": { + "schemaValidConfirmed": { + "operation": "customer_disable_login", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "customer_disable_login", + "request": { + "customerId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_admin_mutations", + "operation": "customer_sync_authentik", + "examples": { + "schemaValidConfirmed": { + "operation": "customer_sync_authentik", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "customer_sync_authentik", + "request": { + "customerId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "create_form", + "examples": { + "schemaValidConfirmed": { + "operation": "create_form", + "request": { + "body": { + "serviceId": "Example", + "title": "Example", + "schema": {} + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_form", + "request": { + "body": { + "serviceId": "Example", + "title": "Example", + "schema": {} + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "serviceId": "Example", + "title": "Example", + "schema": {} + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "update_form", + "examples": { + "schemaValidConfirmed": { + "operation": "update_form", + "request": { + "requestFormId": "Example", + "body": { + "schema": {} + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_form", + "request": { + "requestFormId": "Example", + "body": { + "schema": {} + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestFormId": "Example", + "body": { + "schema": {} + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "create_request_definition", + "examples": { + "schemaValidConfirmed": { + "operation": "create_request_definition", + "request": { + "body": { + "name": "Example", + "clientIdentity": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_request_definition", + "request": { + "body": { + "name": "Example", + "clientIdentity": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "name": "Example", + "clientIdentity": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "bindings", + "examples": { + "schemaValidConfirmed": { + "operation": "bindings", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "get_binding", + "examples": { + "schemaValidConfirmed": { + "operation": "get_binding", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "binding_by_task", + "examples": { + "schemaValidConfirmed": { + "operation": "binding_by_task", + "request": { + "requestFormId": "Example", + "taskTemplateId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestFormId": "Example", + "taskTemplateId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "create_binding", + "examples": { + "schemaValidConfirmed": { + "operation": "create_binding", + "request": { + "body": { + "requestFormId": "Example", + "taskTemplateId": "00000000-0000-0000-0000-000000000001", + "orchestrationRequestDefinitionId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_binding", + "request": { + "body": { + "requestFormId": "Example", + "taskTemplateId": "00000000-0000-0000-0000-000000000001", + "orchestrationRequestDefinitionId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "requestFormId": "Example", + "taskTemplateId": "00000000-0000-0000-0000-000000000001", + "orchestrationRequestDefinitionId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "update_binding", + "examples": { + "schemaValidConfirmed": { + "operation": "update_binding", + "request": { + "bindingId": "Example", + "body": {} + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_binding", + "request": { + "bindingId": "Example", + "body": {} + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "bindingId": "Example", + "body": {} + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "delete_binding", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_binding", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_binding", + "request": { + "bindingId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "sync_binding_inputs", + "examples": { + "schemaValidConfirmed": { + "operation": "sync_binding_inputs", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "sync_binding_inputs", + "request": { + "bindingId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "refresh_binding_drift", + "examples": { + "schemaValidConfirmed": { + "operation": "refresh_binding_drift", + "request": {}, + "confirm": true + }, + "schemaValidPreview": { + "operation": "refresh_binding_drift", + "request": {}, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "mark_binding_import_pending", + "examples": { + "schemaValidConfirmed": { + "operation": "mark_binding_import_pending", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "mark_binding_import_pending", + "request": { + "bindingId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "binding_drift_preview", + "examples": { + "schemaValidConfirmed": { + "operation": "binding_drift_preview", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "import_binding_inputs", + "examples": { + "schemaValidConfirmed": { + "operation": "import_binding_inputs", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "import_binding_inputs", + "request": { + "bindingId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "bindingId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "approver_candidates", + "examples": { + "schemaValidConfirmed": { + "operation": "approver_candidates", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "my_task_approval", + "examples": { + "schemaValidConfirmed": { + "operation": "my_task_approval", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "approve_task", + "examples": { + "schemaValidConfirmed": { + "operation": "approve_task", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "approve_task", + "request": { + "taskId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "taskId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "reject_task", + "examples": { + "schemaValidConfirmed": { + "operation": "reject_task", + "request": { + "taskId": "Example", + "body": { + "reason": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "reject_task", + "request": { + "taskId": "Example", + "body": { + "reason": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "taskId": "Example", + "body": { + "reason": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "workflow_timeline", + "examples": { + "schemaValidConfirmed": { + "operation": "workflow_timeline", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "overdue_tasks", + "examples": { + "schemaValidConfirmed": { + "operation": "overdue_tasks", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "escalated_tasks", + "examples": { + "schemaValidConfirmed": { + "operation": "escalated_tasks", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "pending_retries", + "examples": { + "schemaValidConfirmed": { + "operation": "pending_retries", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "critical_failures", + "examples": { + "schemaValidConfirmed": { + "operation": "critical_failures", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "callback_rejections", + "examples": { + "schemaValidConfirmed": { + "operation": "callback_rejections", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "binding_issues", + "examples": { + "schemaValidConfirmed": { + "operation": "binding_issues", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "workflow_metrics", + "examples": { + "schemaValidConfirmed": { + "operation": "workflow_metrics", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_attachments", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": { + "ticketId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_attachments", + "operation": "download", + "examples": { + "schemaValidConfirmed": { + "operation": "download", + "request": { + "attachmentId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "attachmentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_attachments", + "operation": "upload", + "examples": { + "schemaValidConfirmed": { + "operation": "upload", + "request": { + "ticketId": "Example", + "body": { + "fileName": "fixture.png", + "contentType": "image/png", + "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "upload", + "request": { + "ticketId": "Example", + "body": { + "fileName": "fixture.png", + "contentType": "image/png", + "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketId": "Example", + "body": { + "fileName": "fixture.png", + "contentType": "image/png", + "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_auth", + "operation": "revoke_self", + "examples": { + "schemaValidConfirmed": { + "operation": "revoke_self", + "confirm": true + }, + "schemaValidPreview": { + "operation": "revoke_self", + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "generate_pairing_code", + "examples": { + "schemaValidConfirmed": { + "operation": "generate_pairing_code", + "confirm": true + }, + "schemaValidPreview": { + "operation": "generate_pairing_code", + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "pair", + "examples": { + "schemaValidConfirmed": { + "operation": "pair", + "request": { + "body": { + "address": "Example", + "pairingCode": "Example", + "operationId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "pair", + "request": { + "body": { + "address": "Example", + "pairingCode": "Example", + "operationId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "address": "Example", + "pairingCode": "Example", + "operationId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "directory", + "examples": { + "schemaValidConfirmed": { + "operation": "directory", + "request": { + "pairId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "pairId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "save_mapping", + "examples": { + "schemaValidConfirmed": { + "operation": "save_mapping", + "request": { + "pairId": "Example", + "mappingId": "00000000-0000-0000-0000-000000000001", + "body": { + "id": "Example", + "pairId": "Example", + "name": "Example", + "netRatelTenantId": "Example", + "ratelDeskOrganizationId": "Example", + "createIncidents": true, + "runAutomation": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "save_mapping", + "request": { + "pairId": "Example", + "mappingId": "00000000-0000-0000-0000-000000000001", + "body": { + "id": "Example", + "pairId": "Example", + "name": "Example", + "netRatelTenantId": "Example", + "ratelDeskOrganizationId": "Example", + "createIncidents": true, + "runAutomation": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "pairId": "Example", + "mappingId": "00000000-0000-0000-0000-000000000001", + "body": { + "id": "Example", + "pairId": "Example", + "name": "Example", + "netRatelTenantId": "Example", + "ratelDeskOrganizationId": "Example", + "createIncidents": true, + "runAutomation": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "test_mapping", + "examples": { + "schemaValidConfirmed": { + "operation": "test_mapping", + "request": { + "pairId": "Example", + "mappingId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "test_mapping", + "request": { + "pairId": "Example", + "mappingId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "pairId": "Example", + "mappingId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "delete_mapping", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_mapping", + "request": { + "pairId": "Example", + "mappingId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_mapping", + "request": { + "pairId": "Example", + "mappingId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "pairId": "Example", + "mappingId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "delete_pair", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_pair", + "request": { + "pairId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_pair", + "request": { + "pairId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "pairId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "netclaw_settings", + "examples": { + "schemaValidConfirmed": { + "operation": "netclaw_settings", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "update_netclaw_settings", + "examples": { + "schemaValidConfirmed": { + "operation": "update_netclaw_settings", + "request": { + "body": { + "enabled": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_netclaw_settings", + "request": { + "body": { + "enabled": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "enabled": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "test_netclaw", + "examples": { + "schemaValidConfirmed": { + "operation": "test_netclaw", + "confirm": true + }, + "schemaValidPreview": { + "operation": "test_netclaw", + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "test_netclaw_draft", + "examples": { + "schemaValidConfirmed": { + "operation": "test_netclaw_draft", + "request": { + "body": { + "enabled": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "test_netclaw_draft", + "request": { + "body": { + "enabled": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "enabled": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "pair_netclaw", + "examples": { + "schemaValidConfirmed": { + "operation": "pair_netclaw", + "request": { + "body": { + "pairingCode": "Example", + "expectedRevision": 0, + "endpoint": "Example", + "enabled": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "pair_netclaw", + "request": { + "body": { + "pairingCode": "Example", + "expectedRevision": 0, + "endpoint": "Example", + "enabled": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "pairingCode": "Example", + "expectedRevision": 0, + "endpoint": "Example", + "enabled": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "netclaw_unbound_sessions", + "examples": { + "schemaValidConfirmed": { + "operation": "netclaw_unbound_sessions", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "confirm_netclaw_session_owner", + "examples": { + "schemaValidConfirmed": { + "operation": "confirm_netclaw_session_owner", + "request": { + "body": { + "historicalEndpoint": "Example", + "expectedEligibleConversations": 1, + "conversationIds": [ + "00000000-0000-0000-0000-000000000001" + ] + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "confirm_netclaw_session_owner", + "request": { + "body": { + "historicalEndpoint": "Example", + "expectedEligibleConversations": 1, + "conversationIds": [ + "00000000-0000-0000-0000-000000000001" + ] + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "historicalEndpoint": "Example", + "expectedEligibleConversations": 1, + "conversationIds": [ + "00000000-0000-0000-0000-000000000001" + ] + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "organizations", + "examples": { + "schemaValidConfirmed": { + "operation": "organizations", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "settings", + "examples": { + "schemaValidConfirmed": { + "operation": "settings", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "update_settings", + "examples": { + "schemaValidConfirmed": { + "operation": "update_settings", + "request": { + "organizationId": "Example", + "body": { + "name": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_settings", + "request": { + "organizationId": "Example", + "body": { + "name": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example", + "body": { + "name": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "members", + "examples": { + "schemaValidConfirmed": { + "operation": "members", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "delegable_roles", + "examples": { + "schemaValidConfirmed": { + "operation": "delegable_roles", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "assignments", + "examples": { + "schemaValidConfirmed": { + "operation": "assignments", + "request": { + "organizationId": "Example", + "userId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example", + "userId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "replace_assignments", + "examples": { + "schemaValidConfirmed": { + "operation": "replace_assignments", + "request": { + "organizationId": "Example", + "userId": "Example", + "body": { + "roleKeys": [] + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "replace_assignments", + "request": { + "organizationId": "Example", + "userId": "Example", + "body": { + "roleKeys": [] + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example", + "userId": "Example", + "body": { + "roleKeys": [] + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "create_local_account", + "examples": { + "schemaValidConfirmed": { + "operation": "create_local_account", + "request": { + "body": { + "displayName": "Example", + "email": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_local_account", + "request": { + "body": { + "displayName": "Example", + "email": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "displayName": "Example", + "email": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "reset_local_account", + "examples": { + "schemaValidConfirmed": { + "operation": "reset_local_account", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "reset_local_account", + "request": { + "userId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "reset_customer_login", + "examples": { + "schemaValidConfirmed": { + "operation": "reset_customer_login", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "reset_customer_login", + "request": { + "customerId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "customerId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "local_account_status", + "examples": { + "schemaValidConfirmed": { + "operation": "local_account_status", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "disable_local_account", + "examples": { + "schemaValidConfirmed": { + "operation": "disable_local_account", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "disable_local_account", + "request": { + "userId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "enable_local_account", + "examples": { + "schemaValidConfirmed": { + "operation": "enable_local_account", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "enable_local_account", + "request": { + "userId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "local_account_assignments", + "examples": { + "schemaValidConfirmed": { + "operation": "local_account_assignments", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "replace_local_account_assignments", + "examples": { + "schemaValidConfirmed": { + "operation": "replace_local_account_assignments", + "request": { + "userId": "Example", + "body": { + "assignments": [] + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "replace_local_account_assignments", + "request": { + "userId": "Example", + "body": { + "assignments": [] + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example", + "body": { + "assignments": [] + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "pending", + "examples": { + "schemaValidConfirmed": { + "operation": "pending", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "pending_count", + "examples": { + "schemaValidConfirmed": { + "operation": "pending_count", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "failed", + "examples": { + "schemaValidConfirmed": { + "operation": "failed", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "retry", + "examples": { + "schemaValidConfirmed": { + "operation": "retry", + "request": { + "deliveryId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "retry", + "request": { + "deliveryId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "deliveryId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "outgoing_retry_preview", + "examples": { + "schemaValidConfirmed": { + "operation": "outgoing_retry_preview", + "request": { + "deliveryId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "deliveryId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "retry_current_outgoing", + "examples": { + "schemaValidConfirmed": { + "operation": "retry_current_outgoing", + "request": { + "deliveryId": "Example", + "body": { + "expectedOutgoingVersion": 1, + "expectedMailboxId": "00000000-0000-0000-0000-000000000001", + "expectedMailboxVersion": 1, + "expectedFence": 1, + "confirmed": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "retry_current_outgoing", + "request": { + "deliveryId": "Example", + "body": { + "expectedOutgoingVersion": 1, + "expectedMailboxId": "00000000-0000-0000-0000-000000000001", + "expectedMailboxVersion": 1, + "expectedFence": 1, + "confirmed": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "deliveryId": "Example", + "body": { + "expectedOutgoingVersion": 1, + "expectedMailboxId": "00000000-0000-0000-0000-000000000001", + "expectedMailboxVersion": 1, + "expectedFence": 1, + "confirmed": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "uncertain_retry_preview", + "examples": { + "schemaValidConfirmed": { + "operation": "uncertain_retry_preview", + "request": { + "deliveryId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "deliveryId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "retry_confirmed_undelivered", + "examples": { + "schemaValidConfirmed": { + "operation": "retry_confirmed_undelivered", + "request": { + "deliveryId": "Example", + "body": { + "evidenceReference": "Example123", + "expectedFence": 0, + "expectedOutgoingVersion": 1, + "confirmedNoDelivery": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "retry_confirmed_undelivered", + "request": { + "deliveryId": "Example", + "body": { + "evidenceReference": "Example123", + "expectedFence": 0, + "expectedOutgoingVersion": 1, + "confirmedNoDelivery": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "deliveryId": "Example", + "body": { + "evidenceReference": "Example123", + "expectedFence": 0, + "expectedOutgoingVersion": 1, + "confirmedNoDelivery": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "changed_route_preview", + "examples": { + "schemaValidConfirmed": { + "operation": "changed_route_preview", + "request": { + "deliveryId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "deliveryId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "retry_current_route", + "examples": { + "schemaValidConfirmed": { + "operation": "retry_current_route", + "request": { + "deliveryId": "Example", + "body": { + "expectedFence": 1, + "expectedOriginalMailboxId": "00000000-0000-0000-0000-000000000001", + "expectedCurrentMailboxId": "00000000-0000-0000-0000-000000000001", + "expectedMailboxVersion": 1, + "expectedOutgoingVersion": 1, + "confirmedNewSender": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "retry_current_route", + "request": { + "deliveryId": "Example", + "body": { + "expectedFence": 1, + "expectedOriginalMailboxId": "00000000-0000-0000-0000-000000000001", + "expectedCurrentMailboxId": "00000000-0000-0000-0000-000000000001", + "expectedMailboxVersion": 1, + "expectedOutgoingVersion": 1, + "confirmedNewSender": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "deliveryId": "Example", + "body": { + "expectedFence": 1, + "expectedOriginalMailboxId": "00000000-0000-0000-0000-000000000001", + "expectedCurrentMailboxId": "00000000-0000-0000-0000-000000000001", + "expectedMailboxVersion": 1, + "expectedOutgoingVersion": 1, + "confirmedNewSender": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "pending_organizations", + "examples": { + "schemaValidConfirmed": { + "operation": "pending_organizations", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "pending_actions", + "examples": { + "schemaValidConfirmed": { + "operation": "pending_actions", + "request": { + "body": { + "ids": [ + "00000000-0000-0000-0000-000000000001" + ], + "action": "retry", + "reason": "Example", + "confirmed": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "pending_actions", + "request": { + "body": { + "ids": [ + "00000000-0000-0000-0000-000000000001" + ], + "action": "retry", + "reason": "Example", + "confirmed": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "ids": [ + "00000000-0000-0000-0000-000000000001" + ], + "action": "retry", + "reason": "Example", + "confirmed": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "send", + "examples": { + "schemaValidConfirmed": { + "operation": "send", + "request": { + "body": { + "recipients": [ + "Example" + ], + "subject": "Example", + "htmlMessage": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "send", + "request": { + "body": { + "recipients": [ + "Example" + ], + "subject": "Example", + "htmlMessage": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "recipients": [ + "Example" + ], + "subject": "Example", + "htmlMessage": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_mail", + "operation": "test_provider", + "examples": { + "schemaValidConfirmed": { + "operation": "test_provider", + "confirm": true + }, + "schemaValidPreview": { + "operation": "test_provider", + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "effective", + "examples": { + "schemaValidConfirmed": { + "operation": "effective", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "worker_status", + "examples": { + "schemaValidConfirmed": { + "operation": "worker_status", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "set_worker", + "examples": { + "schemaValidConfirmed": { + "operation": "set_worker", + "request": { + "body": { + "running": true, + "confirmed": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "set_worker", + "request": { + "body": { + "running": true, + "confirmed": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "running": true, + "confirmed": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "create", + "examples": { + "schemaValidConfirmed": { + "operation": "create", + "request": { + "body": { + "displayName": "Example", + "mailboxAddress": "Example", + "provider": 0, + "authentication": 0, + "scope": 0 + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create", + "request": { + "body": { + "displayName": "Example", + "mailboxAddress": "Example", + "provider": 0, + "authentication": 0, + "scope": 0 + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "displayName": "Example", + "mailboxAddress": "Example", + "provider": 0, + "authentication": 0, + "scope": 0 + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "update", + "examples": { + "schemaValidConfirmed": { + "operation": "update", + "request": { + "mailboxId": "Example", + "body": { + "displayName": "Example", + "mailboxAddress": "Example", + "version": 1, + "provider": 0, + "authentication": 0, + "scope": 0 + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update", + "request": { + "mailboxId": "Example", + "body": { + "displayName": "Example", + "mailboxAddress": "Example", + "version": 1, + "provider": 0, + "authentication": 0, + "scope": 0 + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example", + "body": { + "displayName": "Example", + "mailboxAddress": "Example", + "version": 1, + "provider": 0, + "authentication": 0, + "scope": 0 + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "test_mailbox", + "examples": { + "schemaValidConfirmed": { + "operation": "test_mailbox", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "test_mailbox", + "request": { + "mailboxId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "test_draft_mailbox", + "examples": { + "schemaValidConfirmed": { + "operation": "test_draft_mailbox", + "request": { + "body": { + "displayName": "Example", + "mailboxAddress": "Example", + "provider": 0, + "authentication": 0, + "scope": 0 + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "test_draft_mailbox", + "request": { + "body": { + "displayName": "Example", + "mailboxAddress": "Example", + "provider": 0, + "authentication": 0, + "scope": 0 + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "displayName": "Example", + "mailboxAddress": "Example", + "provider": 0, + "authentication": 0, + "scope": 0 + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "enable", + "examples": { + "schemaValidConfirmed": { + "operation": "enable", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "enable", + "request": { + "mailboxId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "disable", + "examples": { + "schemaValidConfirmed": { + "operation": "disable", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "disable", + "request": { + "mailboxId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "sync", + "examples": { + "schemaValidConfirmed": { + "operation": "sync", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "sync", + "request": { + "mailboxId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "archive", + "examples": { + "schemaValidConfirmed": { + "operation": "archive", + "request": { + "mailboxId": "Example", + "body": { + "version": 1, + "confirmed": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "archive", + "request": { + "mailboxId": "Example", + "body": { + "version": 1, + "confirmed": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example", + "body": { + "version": 1, + "confirmed": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "diagnostics", + "examples": { + "schemaValidConfirmed": { + "operation": "diagnostics", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "retry_receipt", + "examples": { + "schemaValidConfirmed": { + "operation": "retry_receipt", + "request": { + "mailboxId": "Example", + "receiptId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "retry_receipt", + "request": { + "mailboxId": "Example", + "receiptId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example", + "receiptId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "historical_preview", + "examples": { + "schemaValidConfirmed": { + "operation": "historical_preview", + "request": { + "mailboxId": "Example", + "body": {} + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "historical_preview", + "request": { + "mailboxId": "Example", + "body": {} + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example", + "body": {} + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "historical_import", + "examples": { + "schemaValidConfirmed": { + "operation": "historical_import", + "request": { + "mailboxId": "Example", + "body": { + "receiptIds": [ + "00000000-0000-0000-0000-000000000001" + ], + "confirmed": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "historical_import", + "request": { + "mailboxId": "Example", + "body": { + "receiptIds": [ + "00000000-0000-0000-0000-000000000001" + ], + "confirmed": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example", + "body": { + "receiptIds": [ + "00000000-0000-0000-0000-000000000001" + ], + "confirmed": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "outgoing", + "examples": { + "schemaValidConfirmed": { + "operation": "outgoing", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "save_outgoing", + "examples": { + "schemaValidConfirmed": { + "operation": "save_outgoing", + "request": { + "mailboxId": "Example", + "body": { + "version": 0, + "enabled": true, + "transport": 0, + "displayName": "Example", + "smtpHost": "Example", + "smtpPort": 1, + "smtpTlsMode": 0, + "smtpUsername": "Example", + "smtpPassword": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "save_outgoing", + "request": { + "mailboxId": "Example", + "body": { + "version": 0, + "enabled": true, + "transport": 0, + "displayName": "Example", + "smtpHost": "Example", + "smtpPort": 1, + "smtpTlsMode": 0, + "smtpUsername": "Example", + "smtpPassword": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example", + "body": { + "version": 0, + "enabled": true, + "transport": 0, + "displayName": "Example", + "smtpHost": "Example", + "smtpPort": 1, + "smtpTlsMode": 0, + "smtpUsername": "Example", + "smtpPassword": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "test_outgoing", + "examples": { + "schemaValidConfirmed": { + "operation": "test_outgoing", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "test_outgoing", + "request": { + "mailboxId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "send_test", + "examples": { + "schemaValidConfirmed": { + "operation": "send_test", + "request": { + "mailboxId": "Example", + "body": { + "recipient": "Example", + "confirmed": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "send_test", + "request": { + "mailboxId": "Example", + "body": { + "recipient": "Example", + "confirmed": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "mailboxId": "Example", + "body": { + "recipient": "Example", + "confirmed": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "rules", + "examples": { + "schemaValidConfirmed": { + "operation": "rules", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "get_rule", + "examples": { + "schemaValidConfirmed": { + "operation": "get_rule", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "create_rule", + "examples": { + "schemaValidConfirmed": { + "operation": "create_rule", + "request": { + "body": { + "scopeType": 0, + "name": "Example", + "enabled": true, + "priority": 1, + "conditions": [], + "actions": [], + "stopProcessing": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_rule", + "request": { + "body": { + "scopeType": 0, + "name": "Example", + "enabled": true, + "priority": 1, + "conditions": [], + "actions": [], + "stopProcessing": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "scopeType": 0, + "name": "Example", + "enabled": true, + "priority": 1, + "conditions": [], + "actions": [], + "stopProcessing": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "update_rule", + "examples": { + "schemaValidConfirmed": { + "operation": "update_rule", + "request": { + "ruleId": "Example", + "body": { + "scopeType": 0, + "name": "Example", + "enabled": true, + "priority": 1, + "conditions": [], + "actions": [], + "stopProcessing": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_rule", + "request": { + "ruleId": "Example", + "body": { + "scopeType": 0, + "name": "Example", + "enabled": true, + "priority": 1, + "conditions": [], + "actions": [], + "stopProcessing": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ruleId": "Example", + "body": { + "scopeType": 0, + "name": "Example", + "enabled": true, + "priority": 1, + "conditions": [], + "actions": [], + "stopProcessing": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "enable_rule", + "examples": { + "schemaValidConfirmed": { + "operation": "enable_rule", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "enable_rule", + "request": { + "ruleId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "disable_rule", + "examples": { + "schemaValidConfirmed": { + "operation": "disable_rule", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "disable_rule", + "request": { + "ruleId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "reorder_rules", + "examples": { + "schemaValidConfirmed": { + "operation": "reorder_rules", + "request": { + "body": { + "rules": [] + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "reorder_rules", + "request": { + "body": { + "rules": [] + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "rules": [] + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "rule_audit", + "examples": { + "schemaValidConfirmed": { + "operation": "rule_audit", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "templates", + "examples": { + "schemaValidConfirmed": { + "operation": "templates", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "create_template", + "examples": { + "schemaValidConfirmed": { + "operation": "create_template", + "request": { + "body": { + "name": "Example", + "subject": "Example", + "htmlContent": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_template", + "request": { + "body": { + "name": "Example", + "subject": "Example", + "htmlContent": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "name": "Example", + "subject": "Example", + "htmlContent": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "update_template", + "examples": { + "schemaValidConfirmed": { + "operation": "update_template", + "request": { + "templateId": 1, + "body": { + "name": "Example", + "subject": "Example", + "htmlContent": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_template", + "request": { + "templateId": 1, + "body": { + "name": "Example", + "subject": "Example", + "htmlContent": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "templateId": 1, + "body": { + "name": "Example", + "subject": "Example", + "htmlContent": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "delete_template", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_template", + "request": { + "templateId": 1 + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_template", + "request": { + "templateId": 1 + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "templateId": 1 + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "preview_template", + "examples": { + "schemaValidConfirmed": { + "operation": "preview_template", + "request": { + "body": {} + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "preview_template", + "request": { + "body": {} + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": {} + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "upload_template_image", + "examples": { + "schemaValidConfirmed": { + "operation": "upload_template_image", + "request": { + "templateName": "Example", + "body": { + "fileName": "fixture.png", + "contentType": "image/png", + "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "upload_template_image", + "request": { + "templateName": "Example", + "body": { + "fileName": "fixture.png", + "contentType": "image/png", + "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "templateName": "Example", + "body": { + "fileName": "fixture.png", + "contentType": "image/png", + "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "layouts", + "examples": { + "schemaValidConfirmed": { + "operation": "layouts", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "layout_choices", + "examples": { + "schemaValidConfirmed": { + "operation": "layout_choices", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "create_layout", + "examples": { + "schemaValidConfirmed": { + "operation": "create_layout", + "request": { + "body": { + "name": "Example", + "htmlContent": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_layout", + "request": { + "body": { + "name": "Example", + "htmlContent": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "name": "Example", + "htmlContent": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "update_layout", + "examples": { + "schemaValidConfirmed": { + "operation": "update_layout", + "request": { + "layoutId": 1, + "body": { + "name": "Example", + "htmlContent": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_layout", + "request": { + "layoutId": 1, + "body": { + "name": "Example", + "htmlContent": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "layoutId": 1, + "body": { + "name": "Example", + "htmlContent": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_email_settings", + "operation": "delete_layout", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_layout", + "request": { + "layoutId": 1 + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_layout", + "request": { + "layoutId": 1 + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "layoutId": 1 + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "groups", + "examples": { + "schemaValidConfirmed": { + "operation": "groups", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "get_group", + "examples": { + "schemaValidConfirmed": { + "operation": "get_group", + "request": { + "groupId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "groupId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "create_group", + "examples": { + "schemaValidConfirmed": { + "operation": "create_group", + "request": { + "body": { + "owningOrganizationId": "Example", + "name": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_group", + "request": { + "body": { + "owningOrganizationId": "Example", + "name": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "owningOrganizationId": "Example", + "name": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "update_group", + "examples": { + "schemaValidConfirmed": { + "operation": "update_group", + "request": { + "groupId": "Example", + "body": { + "owningOrganizationId": "Example", + "name": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_group", + "request": { + "groupId": "Example", + "body": { + "owningOrganizationId": "Example", + "name": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "groupId": "Example", + "body": { + "owningOrganizationId": "Example", + "name": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "delete_group", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_group", + "request": { + "groupId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_group", + "request": { + "groupId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "groupId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "members", + "examples": { + "schemaValidConfirmed": { + "operation": "members", + "request": { + "groupId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "groupId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "add_member", + "examples": { + "schemaValidConfirmed": { + "operation": "add_member", + "request": { + "groupId": "Example", + "body": { + "userId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "add_member", + "request": { + "groupId": "Example", + "body": { + "userId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "groupId": "Example", + "body": { + "userId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "update_member", + "examples": { + "schemaValidConfirmed": { + "operation": "update_member", + "request": { + "groupId": "Example", + "memberId": "Example", + "body": {} + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_member", + "request": { + "groupId": "Example", + "memberId": "Example", + "body": {} + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "groupId": "Example", + "memberId": "Example", + "body": {} + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "remove_member", + "examples": { + "schemaValidConfirmed": { + "operation": "remove_member", + "request": { + "groupId": "Example", + "memberId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "remove_member", + "request": { + "groupId": "Example", + "memberId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "groupId": "Example", + "memberId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "coverage", + "examples": { + "schemaValidConfirmed": { + "operation": "coverage", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "create_coverage", + "examples": { + "schemaValidConfirmed": { + "operation": "create_coverage", + "request": { + "body": { + "customerOrganizationId": "Example", + "providerOrganizationId": "Example", + "supportGroupId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_coverage", + "request": { + "body": { + "customerOrganizationId": "Example", + "providerOrganizationId": "Example", + "supportGroupId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "customerOrganizationId": "Example", + "providerOrganizationId": "Example", + "supportGroupId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "update_coverage", + "examples": { + "schemaValidConfirmed": { + "operation": "update_coverage", + "request": { + "coverageId": "Example", + "body": { + "customerOrganizationId": "Example", + "providerOrganizationId": "Example", + "supportGroupId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_coverage", + "request": { + "coverageId": "Example", + "body": { + "customerOrganizationId": "Example", + "providerOrganizationId": "Example", + "supportGroupId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "coverageId": "Example", + "body": { + "customerOrganizationId": "Example", + "providerOrganizationId": "Example", + "supportGroupId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "delete_coverage", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_coverage", + "request": { + "coverageId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_coverage", + "request": { + "coverageId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "coverageId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "subscriptions", + "examples": { + "schemaValidConfirmed": { + "operation": "subscriptions", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "create_subscription", + "examples": { + "schemaValidConfirmed": { + "operation": "create_subscription", + "request": { + "body": { + "customerOrganizationId": "Example", + "recipientId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_subscription", + "request": { + "body": { + "customerOrganizationId": "Example", + "recipientId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "customerOrganizationId": "Example", + "recipientId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "update_subscription", + "examples": { + "schemaValidConfirmed": { + "operation": "update_subscription", + "request": { + "subscriptionId": "Example", + "body": { + "customerOrganizationId": "Example", + "recipientId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_subscription", + "request": { + "subscriptionId": "Example", + "body": { + "customerOrganizationId": "Example", + "recipientId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "subscriptionId": "Example", + "body": { + "customerOrganizationId": "Example", + "recipientId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "delete_subscription", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_subscription", + "request": { + "subscriptionId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_subscription", + "request": { + "subscriptionId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "subscriptionId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "my_preferences", + "examples": { + "schemaValidConfirmed": { + "operation": "my_preferences", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "set_my_preference", + "examples": { + "schemaValidConfirmed": { + "operation": "set_my_preference", + "request": { + "body": {} + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "set_my_preference", + "request": { + "body": {} + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": {} + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "user_preferences", + "examples": { + "schemaValidConfirmed": { + "operation": "user_preferences", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "set_user_preference", + "examples": { + "schemaValidConfirmed": { + "operation": "set_user_preference", + "request": { + "userId": "Example", + "body": {} + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "set_user_preference", + "request": { + "userId": "Example", + "body": {} + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "userId": "Example", + "body": {} + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "recipient_preview", + "examples": { + "schemaValidConfirmed": { + "operation": "recipient_preview", + "request": { + "eventType": 0, + "organizationId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "eventType": 0, + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_support", + "operation": "bootstrap_defaults", + "examples": { + "schemaValidConfirmed": { + "operation": "bootstrap_defaults", + "confirm": true + }, + "schemaValidPreview": { + "operation": "bootstrap_defaults", + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "policies", + "examples": { + "schemaValidConfirmed": { + "operation": "policies", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "create_policy", + "examples": { + "schemaValidConfirmed": { + "operation": "create_policy", + "request": { + "body": { + "name": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_policy", + "request": { + "body": { + "name": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "name": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "update_policy", + "examples": { + "schemaValidConfirmed": { + "operation": "update_policy", + "request": { + "policyId": "Example", + "body": { + "name": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_policy", + "request": { + "policyId": "Example", + "body": { + "name": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "policyId": "Example", + "body": { + "name": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "delete_policy", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_policy", + "request": { + "policyId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_policy", + "request": { + "policyId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "policyId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "calendars", + "examples": { + "schemaValidConfirmed": { + "operation": "calendars", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "create_calendar", + "examples": { + "schemaValidConfirmed": { + "operation": "create_calendar", + "request": { + "body": { + "name": "Example", + "timeZoneId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_calendar", + "request": { + "body": { + "name": "Example", + "timeZoneId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "name": "Example", + "timeZoneId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "update_calendar", + "examples": { + "schemaValidConfirmed": { + "operation": "update_calendar", + "request": { + "calendarId": "Example", + "body": { + "name": "Example", + "timeZoneId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_calendar", + "request": { + "calendarId": "Example", + "body": { + "name": "Example", + "timeZoneId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "calendarId": "Example", + "body": { + "name": "Example", + "timeZoneId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "delete_calendar", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_calendar", + "request": { + "calendarId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_calendar", + "request": { + "calendarId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "calendarId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "tenant_settings", + "examples": { + "schemaValidConfirmed": { + "operation": "tenant_settings", + "request": { + "tenantId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "tenantId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "save_tenant_settings", + "examples": { + "schemaValidConfirmed": { + "operation": "save_tenant_settings", + "request": { + "tenantId": "Example", + "body": { + "useBusinessHours": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "save_tenant_settings", + "request": { + "tenantId": "Example", + "body": { + "useBusinessHours": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "tenantId": "Example", + "body": { + "useBusinessHours": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "report_subscriptions", + "examples": { + "schemaValidConfirmed": { + "operation": "report_subscriptions", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "create_report_subscription", + "examples": { + "schemaValidConfirmed": { + "operation": "create_report_subscription", + "request": { + "body": { + "tenantId": "Example", + "frequency": 0, + "sendTimeLocal": "09:00:00", + "timeZoneId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_report_subscription", + "request": { + "body": { + "tenantId": "Example", + "frequency": 0, + "sendTimeLocal": "09:00:00", + "timeZoneId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "tenantId": "Example", + "frequency": 0, + "sendTimeLocal": "09:00:00", + "timeZoneId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "update_report_subscription", + "examples": { + "schemaValidConfirmed": { + "operation": "update_report_subscription", + "request": { + "subscriptionId": "Example", + "body": { + "tenantId": "Example", + "frequency": 0, + "sendTimeLocal": "09:00:00", + "timeZoneId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_report_subscription", + "request": { + "subscriptionId": "Example", + "body": { + "tenantId": "Example", + "frequency": 0, + "sendTimeLocal": "09:00:00", + "timeZoneId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "subscriptionId": "Example", + "body": { + "tenantId": "Example", + "frequency": 0, + "sendTimeLocal": "09:00:00", + "timeZoneId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "delete_report_subscription", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_report_subscription", + "request": { + "subscriptionId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_report_subscription", + "request": { + "subscriptionId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "subscriptionId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "compliance", + "examples": { + "schemaValidConfirmed": { + "operation": "compliance", + "request": { + "fromUtc": "2027-01-01T00:00:00Z", + "toUtc": "2027-01-01T00:00:00Z" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "fromUtc": "2027-01-01T00:00:00Z", + "toUtc": "2027-01-01T00:00:00Z" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "breached", + "examples": { + "schemaValidConfirmed": { + "operation": "breached", + "request": { + "page": 1, + "pageSize": 1 + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "page": 1, + "pageSize": 1 + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "near_breach", + "examples": { + "schemaValidConfirmed": { + "operation": "near_breach", + "request": { + "page": 1, + "pageSize": 1, + "thresholdPercent": 1, + "metric": 0 + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "page": 1, + "pageSize": 1, + "thresholdPercent": 1, + "metric": 0 + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "completed", + "examples": { + "schemaValidConfirmed": { + "operation": "completed", + "request": { + "fromUtc": "2027-01-01T00:00:00Z", + "toUtc": "2027-01-01T00:00:00Z", + "page": 1, + "pageSize": 1 + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "fromUtc": "2027-01-01T00:00:00Z", + "toUtc": "2027-01-01T00:00:00Z", + "page": 1, + "pageSize": 1 + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "pause_ticket", + "examples": { + "schemaValidConfirmed": { + "operation": "pause_ticket", + "request": { + "ticketId": "Example", + "body": { + "reason": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "pause_ticket", + "request": { + "ticketId": "Example", + "body": { + "reason": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketId": "Example", + "body": { + "reason": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_sla", + "operation": "resume_ticket", + "examples": { + "schemaValidConfirmed": { + "operation": "resume_ticket", + "request": { + "ticketId": "Example", + "body": {} + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "resume_ticket", + "request": { + "ticketId": "Example", + "body": {} + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketId": "Example", + "body": {} + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "list", + "examples": { + "schemaValidConfirmed": { + "operation": "list", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "get", + "examples": { + "schemaValidConfirmed": { + "operation": "get", + "request": { + "datasetId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "datasetId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "create", + "examples": { + "schemaValidConfirmed": { + "operation": "create", + "request": { + "body": { + "organizationId": "Example", + "name": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create", + "request": { + "body": { + "organizationId": "Example", + "name": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "organizationId": "Example", + "name": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "update", + "examples": { + "schemaValidConfirmed": { + "operation": "update", + "request": { + "datasetId": "Example", + "body": {} + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update", + "request": { + "datasetId": "Example", + "body": {} + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "datasetId": "Example", + "body": {} + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "delete", + "examples": { + "schemaValidConfirmed": { + "operation": "delete", + "request": { + "datasetId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete", + "request": { + "datasetId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "datasetId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "rows", + "examples": { + "schemaValidConfirmed": { + "operation": "rows", + "request": { + "page": 1, + "pageSize": 1, + "datasetId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "page": 1, + "pageSize": 1, + "datasetId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "upsert_rows", + "examples": { + "schemaValidConfirmed": { + "operation": "upsert_rows", + "request": { + "datasetId": "Example", + "body": { + "rows": [], + "deleteMissing": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "upsert_rows", + "request": { + "datasetId": "Example", + "body": { + "rows": [], + "deleteMissing": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "datasetId": "Example", + "body": { + "rows": [], + "deleteMissing": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "credentials", + "examples": { + "schemaValidConfirmed": { + "operation": "credentials", + "request": { + "datasetId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "datasetId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "create_credential", + "examples": { + "schemaValidConfirmed": { + "operation": "create_credential", + "request": { + "datasetId": "Example", + "body": { + "name": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_credential", + "request": { + "datasetId": "Example", + "body": { + "name": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "datasetId": "Example", + "body": { + "name": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "revoke_credential", + "examples": { + "schemaValidConfirmed": { + "operation": "revoke_credential", + "request": { + "datasetId": "Example", + "credentialId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "revoke_credential", + "request": { + "datasetId": "Example", + "credentialId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "datasetId": "Example", + "credentialId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "graph_settings", + "examples": { + "schemaValidConfirmed": { + "operation": "graph_settings", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "save_graph_settings", + "examples": { + "schemaValidConfirmed": { + "operation": "save_graph_settings", + "request": { + "body": { + "organizationId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "save_graph_settings", + "request": { + "body": { + "organizationId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "organizationId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "sync_graph", + "examples": { + "schemaValidConfirmed": { + "operation": "sync_graph", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "sync_graph", + "request": { + "organizationId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_datasets", + "operation": "options", + "examples": { + "schemaValidConfirmed": { + "operation": "options", + "request": { + "page": 1, + "pageSize": 1, + "datasetId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "page": 1, + "pageSize": 1, + "datasetId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "webhook_configurations", + "examples": { + "schemaValidConfirmed": { + "operation": "webhook_configurations", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "create_webhook", + "examples": { + "schemaValidConfirmed": { + "operation": "create_webhook", + "request": { + "body": { + "organizationId": "Example", + "name": "Example", + "ticketAreas": [ + 0 + ], + "endpoint": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_webhook", + "request": { + "body": { + "organizationId": "Example", + "name": "Example", + "ticketAreas": [ + 0 + ], + "endpoint": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "organizationId": "Example", + "name": "Example", + "ticketAreas": [ + 0 + ], + "endpoint": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "update_webhook", + "examples": { + "schemaValidConfirmed": { + "operation": "update_webhook", + "request": { + "webhookId": "00000000-0000-0000-0000-000000000001", + "body": { + "organizationId": "Example", + "name": "Example", + "ticketAreas": [ + 0 + ], + "endpoint": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_webhook", + "request": { + "webhookId": "00000000-0000-0000-0000-000000000001", + "body": { + "organizationId": "Example", + "name": "Example", + "ticketAreas": [ + 0 + ], + "endpoint": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "webhookId": "00000000-0000-0000-0000-000000000001", + "body": { + "organizationId": "Example", + "name": "Example", + "ticketAreas": [ + 0 + ], + "endpoint": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "set_webhook_state", + "examples": { + "schemaValidConfirmed": { + "operation": "set_webhook_state", + "request": { + "webhookId": "00000000-0000-0000-0000-000000000001", + "body": { + "organizationId": "Example", + "enabled": true, + "archived": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "set_webhook_state", + "request": { + "webhookId": "00000000-0000-0000-0000-000000000001", + "body": { + "organizationId": "Example", + "enabled": true, + "archived": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "webhookId": "00000000-0000-0000-0000-000000000001", + "body": { + "organizationId": "Example", + "enabled": true, + "archived": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "eligible_configurations", + "examples": { + "schemaValidConfirmed": { + "operation": "eligible_configurations", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "dispatch_investigation", + "examples": { + "schemaValidConfirmed": { + "operation": "dispatch_investigation", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "configurationId": "00000000-0000-0000-0000-000000000001", + "operatorAssistanceRequest": "Example", + "idempotencyKey": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "dispatch_investigation", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "configurationId": "00000000-0000-0000-0000-000000000001", + "operatorAssistanceRequest": "Example", + "idempotencyKey": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "configurationId": "00000000-0000-0000-0000-000000000001", + "operatorAssistanceRequest": "Example", + "idempotencyKey": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "investigation_worklog", + "examples": { + "schemaValidConfirmed": { + "operation": "investigation_worklog", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_capabilities", + "examples": { + "schemaValidConfirmed": { + "operation": "chat_capabilities", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_open", + "examples": { + "schemaValidConfirmed": { + "operation": "chat_open", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "chat_open", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat", + "examples": { + "schemaValidConfirmed": { + "operation": "chat", + "request": { + "ticketType": "incidents", + "conversationId": "00000000-0000-0000-0000-000000000001", + "ticketId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "conversationId": "00000000-0000-0000-0000-000000000001", + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_history", + "examples": { + "schemaValidConfirmed": { + "operation": "chat_history", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_send", + "examples": { + "schemaValidConfirmed": { + "operation": "chat_send", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "clientMessageId": "00000000-0000-0000-0000-000000000001", + "text": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "chat_send", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "clientMessageId": "00000000-0000-0000-0000-000000000001", + "text": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "clientMessageId": "00000000-0000-0000-0000-000000000001", + "text": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_respond", + "examples": { + "schemaValidConfirmed": { + "operation": "chat_respond", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "callId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "selectedKey": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "chat_respond", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "callId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "selectedKey": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "callId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "selectedKey": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_reconcile", + "examples": { + "schemaValidConfirmed": { + "operation": "chat_reconcile", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "chat_reconcile", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_stop_waiting", + "examples": { + "schemaValidConfirmed": { + "operation": "chat_stop_waiting", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "expectedMessageId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "chat_stop_waiting", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "expectedMessageId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "expectedMessageId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_abandon", + "examples": { + "schemaValidConfirmed": { + "operation": "chat_abandon", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "resolutionId": "00000000-0000-0000-0000-000000000001", + "expectedMessageId": "00000000-0000-0000-0000-000000000001", + "acknowledgePossibleDelivery": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "chat_abandon", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "resolutionId": "00000000-0000-0000-0000-000000000001", + "expectedMessageId": "00000000-0000-0000-0000-000000000001", + "acknowledgePossibleDelivery": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001", + "resolutionId": "00000000-0000-0000-0000-000000000001", + "expectedMessageId": "00000000-0000-0000-0000-000000000001", + "acknowledgePossibleDelivery": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_ai_assistant", + "operation": "chat_new", + "examples": { + "schemaValidConfirmed": { + "operation": "chat_new", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "chat_new", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "conversationId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "rules", + "examples": { + "schemaValidConfirmed": { + "operation": "rules", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "get_rule", + "examples": { + "schemaValidConfirmed": { + "operation": "get_rule", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "create_rule", + "examples": { + "schemaValidConfirmed": { + "operation": "create_rule", + "request": { + "body": { + "name": "Example", + "trigger": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_rule", + "request": { + "body": { + "name": "Example", + "trigger": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "name": "Example", + "trigger": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "update_rule", + "examples": { + "schemaValidConfirmed": { + "operation": "update_rule", + "request": { + "ruleId": "Example", + "body": { + "name": "Example", + "trigger": "Example", + "conditions": "Example", + "actions": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_rule", + "request": { + "ruleId": "Example", + "body": { + "name": "Example", + "trigger": "Example", + "conditions": "Example", + "actions": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ruleId": "Example", + "body": { + "name": "Example", + "trigger": "Example", + "conditions": "Example", + "actions": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_automation", + "operation": "delete_rule", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_rule", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_rule", + "request": { + "ruleId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "assets", + "examples": { + "schemaValidConfirmed": { + "operation": "assets", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "get_asset", + "examples": { + "schemaValidConfirmed": { + "operation": "get_asset", + "request": { + "assetId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "assetId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "create_asset", + "examples": { + "schemaValidConfirmed": { + "operation": "create_asset", + "request": { + "body": { + "name": "Example", + "organizationId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_asset", + "request": { + "body": { + "name": "Example", + "organizationId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "name": "Example", + "organizationId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "update_asset", + "examples": { + "schemaValidConfirmed": { + "operation": "update_asset", + "request": { + "assetId": "Example", + "body": { + "name": "Example", + "organizationId": "Example", + "type": "Example", + "manufacturer": "Example", + "model": "Example", + "serialNumber": "Example", + "notes": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_asset", + "request": { + "assetId": "Example", + "body": { + "name": "Example", + "organizationId": "Example", + "type": "Example", + "manufacturer": "Example", + "model": "Example", + "serialNumber": "Example", + "notes": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "assetId": "Example", + "body": { + "name": "Example", + "organizationId": "Example", + "type": "Example", + "manufacturer": "Example", + "model": "Example", + "serialNumber": "Example", + "notes": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "delete_asset", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_asset", + "request": { + "assetId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_asset", + "request": { + "assetId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "assetId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "instance_branding", + "examples": { + "schemaValidConfirmed": { + "operation": "instance_branding", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "update_instance_branding", + "examples": { + "schemaValidConfirmed": { + "operation": "update_instance_branding", + "request": { + "body": { + "applicationName": "Example", + "organizationName": "Example", + "applicationUrl": "Example", + "organizationUrl": "Example", + "supportUrl": "Example", + "supportEmail": "Example", + "logoUrl": "Example", + "compactLogoUrl": "Example", + "faviconUrl": "Example", + "emailFromDisplayName": "Example", + "tagline": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_instance_branding", + "request": { + "body": { + "applicationName": "Example", + "organizationName": "Example", + "applicationUrl": "Example", + "organizationUrl": "Example", + "supportUrl": "Example", + "supportEmail": "Example", + "logoUrl": "Example", + "compactLogoUrl": "Example", + "faviconUrl": "Example", + "emailFromDisplayName": "Example", + "tagline": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "applicationName": "Example", + "organizationName": "Example", + "applicationUrl": "Example", + "organizationUrl": "Example", + "supportUrl": "Example", + "supportEmail": "Example", + "logoUrl": "Example", + "compactLogoUrl": "Example", + "faviconUrl": "Example", + "emailFromDisplayName": "Example", + "tagline": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "tenant_branding", + "examples": { + "schemaValidConfirmed": { + "operation": "tenant_branding", + "request": { + "brandingTenantId": 1 + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "brandingTenantId": 1 + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "upload_branding_logo", + "examples": { + "schemaValidConfirmed": { + "operation": "upload_branding_logo", + "request": { + "brandingTenantId": 1, + "body": { + "fileName": "fixture.png", + "contentType": "image/png", + "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "upload_branding_logo", + "request": { + "brandingTenantId": 1, + "body": { + "fileName": "fixture.png", + "contentType": "image/png", + "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "brandingTenantId": 1, + "body": { + "fileName": "fixture.png", + "contentType": "image/png", + "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "background_worker_settings", + "examples": { + "schemaValidConfirmed": { + "operation": "background_worker_settings", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "update_background_worker_settings", + "examples": { + "schemaValidConfirmed": { + "operation": "update_background_worker_settings", + "request": { + "body": { + "enabled": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "update_background_worker_settings", + "request": { + "body": { + "enabled": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "enabled": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "my_credentials", + "examples": { + "schemaValidConfirmed": { + "operation": "my_credentials", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "revoke_my_credential", + "examples": { + "schemaValidConfirmed": { + "operation": "revoke_my_credential", + "request": { + "credentialId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "revoke_my_credential", + "request": { + "credentialId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "credentialId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "delete_my_credential_record", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_my_credential_record", + "request": { + "credentialId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_my_credential_record", + "request": { + "credentialId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "credentialId": "00000000-0000-0000-0000-000000000001" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "incident_sources", + "examples": { + "schemaValidConfirmed": { + "operation": "incident_sources", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "register_incident_source", + "examples": { + "schemaValidConfirmed": { + "operation": "register_incident_source", + "request": { + "body": { + "sourceInstanceId": "00000000-0000-0000-0000-000000000001", + "organizationId": "Example", + "customerId": "Example", + "credentialId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "register_incident_source", + "request": { + "body": { + "sourceInstanceId": "00000000-0000-0000-0000-000000000001", + "organizationId": "Example", + "customerId": "Example", + "credentialId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "sourceInstanceId": "00000000-0000-0000-0000-000000000001", + "organizationId": "Example", + "customerId": "Example", + "credentialId": "00000000-0000-0000-0000-000000000001" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "set_incident_source_state", + "examples": { + "schemaValidConfirmed": { + "operation": "set_incident_source_state", + "request": { + "namespaceId": "00000000-0000-0000-0000-000000000001", + "body": { + "expectedRevision": 1, + "isEnabled": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "set_incident_source_state", + "request": { + "namespaceId": "00000000-0000-0000-0000-000000000001", + "body": { + "expectedRevision": 1, + "isEnabled": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "namespaceId": "00000000-0000-0000-0000-000000000001", + "body": { + "expectedRevision": 1, + "isEnabled": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_connections", + "operation": "set_incident_source_credential", + "examples": { + "schemaValidConfirmed": { + "operation": "set_incident_source_credential", + "request": { + "credentialId": "00000000-0000-0000-0000-000000000001", + "namespaceId": "00000000-0000-0000-0000-000000000001", + "body": { + "expectedRevision": 1, + "isEnabled": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "set_incident_source_credential", + "request": { + "credentialId": "00000000-0000-0000-0000-000000000001", + "namespaceId": "00000000-0000-0000-0000-000000000001", + "body": { + "expectedRevision": 1, + "isEnabled": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "credentialId": "00000000-0000-0000-0000-000000000001", + "namespaceId": "00000000-0000-0000-0000-000000000001", + "body": { + "expectedRevision": 1, + "isEnabled": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "organization_options", + "examples": { + "schemaValidConfirmed": { + "operation": "organization_options", + "request": { + "module": "incident" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "module": "incident" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "customer_options", + "examples": { + "schemaValidConfirmed": { + "operation": "customer_options", + "request": { + "organizationId": "Example", + "module": "incident" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example", + "module": "incident" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "search_assignees", + "examples": { + "schemaValidConfirmed": { + "operation": "search_assignees", + "request": { + "organizationId": "Example", + "module": "incident" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "organizationId": "Example", + "module": "incident" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "current_assignee", + "examples": { + "schemaValidConfirmed": { + "operation": "current_assignee", + "request": { + "ticketId": "Example", + "organizationId": "Example", + "module": "incident" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketId": "Example", + "organizationId": "Example", + "module": "incident" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "filter_options", + "examples": { + "schemaValidConfirmed": { + "operation": "filter_options", + "request": { + "dimension": "customer", + "module": "incident" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "dimension": "customer", + "module": "incident" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "set_customer", + "examples": { + "schemaValidConfirmed": { + "operation": "set_customer", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "customerId": "Example" + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "set_customer", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "customerId": "Example" + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ticketType": "incidents", + "ticketId": "Example", + "body": { + "customerId": "Example" + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "incident_activity", + "examples": { + "schemaValidConfirmed": { + "operation": "incident_activity", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "request_worklogs", + "examples": { + "schemaValidConfirmed": { + "operation": "request_worklogs", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tickets", + "operation": "self_service_tasks", + "examples": { + "schemaValidConfirmed": { + "operation": "self_service_tasks", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "requestId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "my_approval", + "examples": { + "schemaValidConfirmed": { + "operation": "my_approval", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_changes", + "operation": "review_approval", + "examples": { + "schemaValidConfirmed": { + "operation": "review_approval", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "review_approval", + "request": { + "changeId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "changeId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "dashboard", + "examples": { + "schemaValidConfirmed": { + "operation": "dashboard", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "technician_dashboard", + "examples": { + "schemaValidConfirmed": { + "operation": "technician_dashboard", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "customer_dashboard", + "examples": { + "schemaValidConfirmed": { + "operation": "customer_dashboard", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_tenant_admin", + "operation": "online_users", + "examples": { + "schemaValidConfirmed": { + "operation": "online_users", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "unread", + "examples": { + "schemaValidConfirmed": { + "operation": "unread", + "request": {}, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": {}, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "error_summary", + "examples": { + "schemaValidConfirmed": { + "operation": "error_summary", + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_notifications", + "operation": "timeline", + "examples": { + "schemaValidConfirmed": { + "operation": "timeline", + "request": { + "reference": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "reference": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "relations", + "examples": { + "schemaValidConfirmed": { + "operation": "relations", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "create_relation", + "examples": { + "schemaValidConfirmed": { + "operation": "create_relation", + "request": { + "incidentId": "Example", + "body": { + "targetTicketId": "Example", + "relationType": 0, + "closeSourceTicket": true + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "create_relation", + "request": { + "incidentId": "Example", + "body": { + "targetTicketId": "Example", + "relationType": 0, + "closeSourceTicket": true + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "incidentId": "Example", + "body": { + "targetTicketId": "Example", + "relationType": 0, + "closeSourceTicket": true + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "delete_relation", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_relation", + "request": { + "relationId": "00000000-0000-0000-0000-000000000001", + "incidentId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_relation", + "request": { + "relationId": "00000000-0000-0000-0000-000000000001", + "incidentId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "relationId": "00000000-0000-0000-0000-000000000001", + "incidentId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "bulk_delete", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_delete", + "request": { + "body": { + "ids": [ + "Example" + ] + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_delete", + "request": { + "body": { + "ids": [ + "Example" + ] + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "ids": [ + "Example" + ] + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, + { + "tool": "helpdesk_incidents", + "operation": "bulk_marketing_spam", + "examples": { + "schemaValidConfirmed": { + "operation": "bulk_marketing_spam", + "request": { + "body": { + "ids": [ + "Example" + ] + } + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "bulk_marketing_spam", + "request": { + "body": { + "ids": [ + "Example" + ] + } + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "body": { + "ids": [ + "Example" + ] + } + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + } + ], + "toolSchemas": [ + { + "tool": "helpdesk_admin_mutations", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_organization", + "description": "create_organization operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string", + "minLength": 1 + }, + "dnsName": { + "type": [ + "string", + "null" + ] + }, + "contactInfo": { + "type": [ + "string", + "null" + ] + }, + "assignedSlaId": { + "type": [ + "string", + "null" + ] + }, + "itSupportOrganizationId": { + "type": [ + "string", + "null" + ] + }, + "orchestrationTenantId": { + "type": [ + "integer", + "null" + ] + }, + "orchestrationTenantName": { + "type": [ + "string", + "null" + ] + }, + "state": { + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_organization. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_organization", + "description": "update_organization operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "dnsName": { + "type": [ + "string", + "null" + ] + }, + "contactInfo": { + "type": [ + "string", + "null" + ] + }, + "assignedSlaId": { + "type": [ + "string", + "null" + ] + }, + "itSupportOrganizationId": { + "type": [ + "string", + "null" + ] + }, + "orchestrationTenantId": { + "type": [ + "integer", + "null" + ] + }, + "orchestrationTenantName": { + "type": [ + "string", + "null" + ] + }, + "state": { + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "organizationId", + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_organization. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_organization", + "description": "delete_organization operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "organizationId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_organization. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_customer", + "description": "create_customer operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "name": { + "type": "string", + "minLength": 1 + }, + "email": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "state": { + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "name", + "email", + "organizationId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_customer. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_customer", + "description": "update_customer operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "email": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "state": { + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "customerId", + "name", + "email", + "organizationId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_customer. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_customer", + "description": "delete_customer operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_customer. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_user", + "description": "create_user operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1 + }, + "email": { + "type": "string", + "minLength": 1 + }, + "role": { + "type": "string", + "minLength": 1 + }, + "isTestUser": { + "type": "boolean" + }, + "organizationId": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "name", + "email", + "role" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_user. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_user", + "description": "update_user operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "email": { + "type": "string", + "minLength": 1 + }, + "role": { + "type": "string", + "minLength": 1 + }, + "isTestUser": { + "type": "boolean" + }, + "organizationId": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "userId", + "name", + "email", + "role" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_user. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_user", + "description": "delete_user operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "userId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_user. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_category", + "description": "create_category operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "type": { + "enum": [ + 0, + 1, + 2, + 3 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "format": "uuid" + }, + "parentCategoryId": { + "type": [ + "string", + "null" + ], + "format": "uuid" + }, + "sortOrder": { + "type": "integer" + }, + "isActive": { + "type": "boolean" + } + }, + "required": [ + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_category. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_category", + "description": "update_category operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "categoryId": { + "type": "string", + "format": "uuid", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "type": { + "enum": [ + 0, + 1, + 2, + 3 + ] + }, + "parentCategoryId": { + "type": [ + "string", + "null" + ], + "format": "uuid" + }, + "sortOrder": { + "type": "integer" + }, + "isActive": { + "type": "boolean" + } + }, + "required": [ + "categoryId", + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_category. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_category", + "description": "delete_category operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "categoryId": { + "type": "string", + "format": "uuid", + "minLength": 1 + } + }, + "required": [ + "categoryId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_category. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_service", + "description": "create_service operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string" + }, + "parentId": { + "type": [ + "string", + "null" + ] + }, + "allowedCustomerIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "allowedOrganizationIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_service. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_service", + "description": "update_service operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string" + }, + "parentId": { + "type": [ + "string", + "null" + ] + }, + "allowedCustomerIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "allowedOrganizationIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "serviceId", + "name" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_service. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_service", + "description": "delete_service operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "serviceId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_service. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_role", + "description": "create_role operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1 + }, + "permissions": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "type": "string", + "enum": [ + "SelfService.User", + "Incident.User", + "Incident.Manager", + "Incident.Read", + "Incident.Write", + "Incident.Delete", + "Request.User", + "Request.Manager", + "Request.Read", + "Request.Write", + "Request.Delete", + "Request.Execute", + "Change.User", + "Change.Manager", + "Change.Read", + "Change.Write", + "Change.Delete", + "Change.Approve", + "DataManagement.Admin", + "Tenant.Users.Manage", + "Tenant.Roles.Assign", + "Tenant.Settings.Manage", + "Tenant.Customers.Manage", + "Tenant.Sla.Manage" + ] + } + }, + "key": { + "type": [ + "string", + "null" + ], + "description": "Optional custom. key using letters, numbers, periods or hyphens, at most 128 characters after trimming; omitted/blank generates a key from name." + }, + "ownerOrganizationId": { + "type": "string", + "minLength": 1, + "pattern": "\\S", + "description": "Required enabled owner organization; scoped role authority and delegable permission intersection apply." + } + }, + "required": [ + "name", + "permissions", + "ownerOrganizationId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_role. All operation-specific fields belong inside this request object, never at the tool root.", + "allOf": [ + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Execute" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Approve" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + } + ] + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_role", + "description": "update_role operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "roleId": { + "type": "string", + "minLength": 1 + }, + "name": { + "type": "string", + "minLength": 1 + }, + "permissions": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "type": "string", + "enum": [ + "SelfService.User", + "Incident.User", + "Incident.Manager", + "Incident.Read", + "Incident.Write", + "Incident.Delete", + "Request.User", + "Request.Manager", + "Request.Read", + "Request.Write", + "Request.Delete", + "Request.Execute", + "Change.User", + "Change.Manager", + "Change.Read", + "Change.Write", + "Change.Delete", + "Change.Approve", + "DataManagement.Admin", + "Tenant.Users.Manage", + "Tenant.Roles.Assign", + "Tenant.Settings.Manage", + "Tenant.Customers.Manage", + "Tenant.Sla.Manage" + ] + } + } + }, + "required": [ + "roleId", + "name", + "permissions" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_role. All operation-specific fields belong inside this request object, never at the tool root.", + "allOf": [ + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Incident.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Incident.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Request.Execute" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Request.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Manager" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.User" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Write" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Delete" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + }, + { + "if": { + "required": [ + "permissions" + ], + "properties": { + "permissions": { + "contains": { + "const": "Change.Approve" + } + } + } + }, + "then": { + "properties": { + "permissions": { + "contains": { + "const": "Change.Read" + } + } + } + } + } + ] + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_role", + "description": "delete_role operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "roleId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "roleId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_role. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_request_form", + "description": "create_request_form operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + }, + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "jsonSchema": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": [ + "string", + "null" + ] + }, + "allowedOrganizationIds": { + "type": "array", + "items": { + "type": "string" + } + }, + "releaseStatus": { + "enum": [ + 0, + 1 + ] + } + }, + "required": [ + "serviceId", + "title", + "jsonSchema" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_request_form. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_service_request_form", + "description": "create_service_request_form operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + }, + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "jsonSchema": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": [ + "string", + "null" + ] + }, + "allowedOrganizationIds": { + "type": "array", + "items": { + "type": "string" + } + }, + "releaseStatus": { + "enum": [ + 0, + 1 + ] + } + }, + "required": [ + "serviceId", + "title", + "jsonSchema" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_service_request_form. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "provision_user", + "description": "provision_user operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_organization_branding", + "description": "update_organization_branding operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": "integer", + "minimum": 1 + }, + "brandName": { + "type": [ + "string", + "null" + ] + }, + "logoUrl": { + "type": [ + "string", + "null" + ] + }, + "footerHtml": { + "type": [ + "string", + "null" + ] + }, + "primaryColor": { + "type": [ + "string", + "null" + ] + }, + "fromName": { + "type": [ + "string", + "null" + ] + }, + "replyTo": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "tenantId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_organization_branding. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_request_form", + "description": "update_request_form operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "minLength": 1 + }, + "title": { + "type": [ + "string", + "null" + ] + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "jsonSchema": { + "type": [ + "string", + "null" + ] + }, + "serviceIdHasValue": { + "type": "boolean" + }, + "serviceId": { + "type": [ + "string", + "null" + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ] + }, + "allowedOrganizationIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "releaseStatus": { + "enum": [ + 0, + 1, + null + ] + } + }, + "required": [ + "requestFormId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation update_request_form. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_request_form", + "description": "delete_request_form operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestFormId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation delete_request_form. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_self_service_request", + "description": "create_self_service_request operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "minLength": 1 + }, + "title": { + "type": [ + "string", + "null" + ] + }, + "description": { + "type": [ + "string", + "null" + ] + }, + "payloadJson": { + "type": "string" + }, + "requesterEmail": { + "type": [ + "string", + "null" + ] + }, + "requesterName": { + "type": [ + "string", + "null" + ] + }, + "requestedForPersonId": { + "type": [ + "string", + "null" + ] + }, + "requestedForPersonSource": { + "enum": [ + 0, + 1, + null + ] + } + }, + "required": [ + "requestFormId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation create_self_service_request. All operation-specific fields belong inside this request object, never at the tool root.", + "dependentRequired": { + "requestedForPersonId": [ + "requestedForPersonSource" + ] + } + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "customer_invite", + "description": "customer_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation customer_invite. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "customer_resend_invite", + "description": "customer_resend_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation customer_resend_invite. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "customer_disable_login", + "description": "customer_disable_login manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation customer_disable_login. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "customer_sync_authentik", + "description": "customer_sync_authentik manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "AdministrativeMutationRequest for helpdesk_admin_mutations operation customer_sync_authentik. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_ai_assistant", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "report", + "description": "report operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "This narrowly authorized autonomous write does not require confirmation; existing API authority and invocation binding still apply." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "invocationId": { + "type": "string", + "format": "uuid", + "minLength": 1 + }, + "eventId": { + "type": "string", + "minLength": 1 + }, + "ticketId": { + "type": "string", + "minLength": 1 + }, + "correlationId": { + "type": "string", + "minLength": 1 + }, + "message": { + "type": "string", + "minLength": 1 + }, + "ticketType": { + "type": "string", + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1 + }, + "status": { + "type": "string", + "enum": [ + "Queued", + "Started", + "Progress", + "Finding", + "ActionAwaitingApproval", + "Completed", + "Failed", + "Cancelled" + ], + "minLength": 1 + }, + "severity": { + "type": [ + "string", + "null" + ] + }, + "metadataJson": { + "type": [ + "string", + "null" + ] + }, + "artifactReferencesJson": { + "type": [ + "string", + "null" + ] + }, + "runReference": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "invocationId", + "eventId", + "ticketId", + "correlationId", + "message", + "ticketType", + "status" + ], + "description": "AiAssistantWorklogRequest for helpdesk_ai_assistant operation report. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "webhook_configurations", + "description": "List AI webhook configurations for one explicit organization, including enabled/archived state and signing-secret availability; stored secrets remain write-only. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_webhook", + "description": "Create an organization-bound AI assistance webhook with numeric ticket areas (0 incidents, 1 requests, 2 changes). The API validates the configured endpoint; no investigation is dispatched by saving settings. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "ticketAreas": { + "type": "array", + "maxItems": 3, + "items": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "minItems": 1 + }, + "endpoint": { + "type": "string", + "maxLength": 2048, + "minLength": 1, + "pattern": "\\S" + }, + "routeName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "promptTemplate": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "permittedInputsSchemaJson": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "timeoutSeconds": { + "type": "integer", + "minimum": 1, + "maximum": 120 + }, + "maxBodyBytes": { + "type": "integer", + "minimum": 1024, + "maximum": 262144 + }, + "signingSecret": { + "type": [ + "string", + "null" + ], + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "organizationId", + "name", + "ticketAreas", + "endpoint" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_webhook", + "description": "Replace the selected AI webhook configuration within its explicit organization. Omit signingSecret or supply an empty value to preserve it; a supplied nonempty secret rotates it without readback. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "webhookId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "ticketAreas": { + "type": "array", + "maxItems": 3, + "items": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "minItems": 1 + }, + "endpoint": { + "type": "string", + "maxLength": 2048, + "minLength": 1, + "pattern": "\\S" + }, + "routeName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "promptTemplate": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "permittedInputsSchemaJson": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "timeoutSeconds": { + "type": "integer", + "minimum": 1, + "maximum": 120 + }, + "maxBodyBytes": { + "type": "integer", + "minimum": 1024, + "maximum": 262144 + }, + "signingSecret": { + "type": [ + "string", + "null" + ], + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "organizationId", + "name", + "ticketAreas", + "endpoint" + ] + } + }, + "required": [ + "webhookId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "set_webhook_state", + "description": "Enable, disable, archive or restore an organization-bound AI webhook configuration with an attributed administrative audit. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "webhookId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "enabled": { + "type": "boolean" + }, + "archived": { + "type": "boolean" + } + }, + "required": [ + "organizationId", + "enabled", + "archived" + ] + } + }, + "required": [ + "webhookId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "eligible_configurations", + "description": "List active AI webhook configurations eligible for this incident, request or change and its actual organization. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "dispatch_investigation", + "description": "Dispatch one AI investigation using a saved eligible configuration and an explicit operator assistance request. Keep the same idempotencyKey for retries of this exact ticket, configuration and request; read investigation_worklog before retrying an uncertain result. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "configurationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "operatorAssistanceRequest": { + "type": "string", + "maxLength": 16000, + "minLength": 1, + "pattern": "\\S" + }, + "idempotencyKey": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "configurationId", + "operatorAssistanceRequest", + "idempotencyKey" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "investigation_worklog", + "description": "Read persisted investigation identities, correlation IDs, progress and outcomes for this ticket. This snapshot provides the worklog evidence also shown by the UI stream. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "chat_capabilities", + "description": "Read native chat availability and its actual disabled reason. SQLite or deployment-disabled native chat is an unavailable capability, not a successful chat campaign. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "chat_open", + "description": "Open the current native conversation, creating the first one when absent. This canonical GET can persist a conversation, so the MCP operation requires explicit confirmation. Read chat_capabilities first. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "chat", + "description": "Read at most 200 durable events after cursor from an explicit existing conversation without creating one. Use its returned lastSequence and event sequence values to read remaining pages. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "cursor": { + "type": [ + "integer", + "null" + ], + "minimum": 0, + "maximum": 9223372036854775807 + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "conversationId", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "chat_history", + "description": "List up to 50 native conversations for this ticket, active first, with skip for older pages. Provider credentials and session paths are excluded. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "skip": { + "type": [ + "integer", + "null" + ], + "minimum": 0, + "maximum": 2147483647 + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "chat_send", + "description": "Submit one native chat message with a stable clientMessageId. Retry only the exact same text and identity; if delivery is uncertain, inspect chat and use chat_reconcile without resending. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "clientMessageId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "text": { + "type": "string", + "maxLength": 16000, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "conversationId", + "clientMessageId", + "text" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "chat_respond", + "description": "Select one exact offered option for the current interaction. Conversation, call ID, option and current awaiting-approval state remain enforced by the canonical API. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "callId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "selectedKey": { + "type": "string", + "maxLength": 1024, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "conversationId", + "selectedKey" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "callId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "chat_reconcile", + "description": "Request conservative recovery of an unresolved native turn using the saved provider session. This never resends the operator message. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [ + "conversationId" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "chat_stop_waiting", + "description": "Stop waiting for the explicitly identified uncertain turn and retire its local transport owner. This records uncertainty and never claims remote cancellation or resends the message. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "expectedMessageId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [ + "conversationId", + "expectedMessageId" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "chat_abandon", + "description": "Abandon unresolved delivery using stable resolutionId and expectedMessageId with explicit acknowledgement that the previous remote turn may still execute. The canonical API audits and serializes this resolution. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "resolutionId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "expectedMessageId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "acknowledgePossibleDelivery": { + "type": "boolean", + "enum": [ + true + ] + } + }, + "required": [ + "conversationId", + "resolutionId", + "expectedMessageId", + "acknowledgePossibleDelivery" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "chat_new", + "description": "Archive the selected idle conversation and open a blank one. Active or unresolved turns must first complete or use the explicit recovery/abandon lifecycle. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "conversationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [ + "conversationId" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_attachments", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "List authorized attachment metadata for an incident, request or change. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ticketId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "download", + "description": "Read a bounded attachment as base64 with its media type and filename; maximum file size is 1 MiB. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "attachmentId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "attachmentId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "upload", + "description": "Upload one base64 attachment, at most 1 MiB, using the authenticated multipart endpoint. The API enforces the parent ticket\u0027s authority. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "fileName": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "pattern": "^(?!\\.{1,2}$)[^/\\\\\\u0000-\\u001F\\u007F-\\u009F]\u002B$", + "examples": [ + "fixture.png" + ] + }, + "contentType": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "^[A-Za-z0-9!#$\u0026^_.\u002B-]\u002B/[A-Za-z0-9!#$\u0026^_.\u002B-]\u002B$", + "examples": [ + "image/png" + ] + }, + "contentBase64": { + "type": "string", + "maxLength": 1398104, + "minLength": 1, + "pattern": "^(?:[A-Za-z0-9\u002B/]{4})*(?:[A-Za-z0-9\u002B/]{2}==|[A-Za-z0-9\u002B/]{3}=)?$", + "examples": [ + "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + ], + "description": "Base64 file bytes, 1 byte through 1 MiB after decoding. No data-URL prefix or embedded whitespace." + } + }, + "required": [ + "fileName", + "contentType", + "contentBase64" + ] + } + }, + "required": [ + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_auth", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "status", + "description": "Read the authenticated agent status. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "access", + "description": "Read the current downstream execution principal\u0027s API permissions, organization scope and linked customer; external HTTP ingress identity remains separate. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "revoke_self", + "description": "Revoke the credential used by this request. The next authenticated call will fail until a separately authorized credential is supplied. This cannot issue or broaden another credential. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_automation", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_form", + "description": "Create a self-service request form with a typed fields/tasks schema. Set releaseStatus, audience and each automation task\u0027s autoStart deliberately. Task IDs and dependency IDs are UUIDs; the API validates the dependency graph and dataset bindings. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "title": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "schema": { + "type": "object", + "additionalProperties": false, + "properties": { + "fields": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "label": { + "type": "string", + "maxLength": 262144 + }, + "key": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "type": { + "type": "string", + "maxLength": 262144 + }, + "required": { + "type": "boolean" + }, + "dataBinding": { + "type": [ + "object", + "null" + ], + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "maxLength": 262144 + }, + "displayColumn": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "searchColumns": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "placeholder": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowFreeText": { + "type": "boolean" + }, + "minSearchLength": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [] + }, + "predefinedOptions": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + } + }, + "required": [] + } + }, + "tasks": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "order": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "type": { + "type": "string", + "maxLength": 262144 + }, + "autoStart": { + "type": "boolean" + }, + "defaultAssigneeId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "teamOrRole": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "orchestratorJobName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "payloadMapping": { + "type": [ + "object", + "null" + ], + "maxProperties": 100, + "additionalProperties": { + "type": "string", + "maxLength": 262144 + } + }, + "expectedRuntimeMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "graceRuntimeMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "dependsOn": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "conditionExpression": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "taskSlaMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "escalateAfterMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "escalationUserId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "escalationRole": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "isCritical": { + "type": "boolean" + }, + "maxRetries": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "retryDelayMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "failurePolicy": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "approvalAllowedDays": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "approvalApprovers": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "source": { + "type": "string", + "maxLength": 262144 + }, + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "email": { + "type": "string", + "maxLength": 262144 + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "organizationName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + } + }, + "required": [] + } + } + }, + "required": [] + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowedOrganizationIds": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "releaseStatus": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + null + ] + } + }, + "required": [ + "serviceId", + "title", + "schema" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_form", + "description": "Edit a self-service form through its typed fields/tasks schema; omitted audience and release status remain unchanged. Existing bindings are managed separately through binding operations. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "schema": { + "type": "object", + "additionalProperties": false, + "properties": { + "fields": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "label": { + "type": "string", + "maxLength": 262144 + }, + "key": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "type": { + "type": "string", + "maxLength": 262144 + }, + "required": { + "type": "boolean" + }, + "dataBinding": { + "type": [ + "object", + "null" + ], + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "maxLength": 262144 + }, + "displayColumn": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "searchColumns": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "placeholder": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowFreeText": { + "type": "boolean" + }, + "minSearchLength": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [] + }, + "predefinedOptions": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + } + }, + "required": [] + } + }, + "tasks": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "order": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "type": { + "type": "string", + "maxLength": 262144 + }, + "autoStart": { + "type": "boolean" + }, + "defaultAssigneeId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "teamOrRole": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "orchestratorJobName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "payloadMapping": { + "type": [ + "object", + "null" + ], + "maxProperties": 100, + "additionalProperties": { + "type": "string", + "maxLength": 262144 + } + }, + "expectedRuntimeMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "graceRuntimeMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "dependsOn": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "conditionExpression": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "taskSlaMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "escalateAfterMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "escalationUserId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "escalationRole": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "isCritical": { + "type": "boolean" + }, + "maxRetries": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "retryDelayMinutes": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "failurePolicy": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "approvalAllowedDays": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "approvalApprovers": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "source": { + "type": "string", + "maxLength": 262144 + }, + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "email": { + "type": "string", + "maxLength": 262144 + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "organizationName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + } + }, + "required": [] + } + } + }, + "required": [] + }, + "title": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowedOrganizationIds": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "releaseStatus": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + null + ] + }, + "serviceIdHasValue": { + "type": [ + "boolean", + "null" + ] + }, + "serviceId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [ + "schema" + ] + } + }, + "required": [ + "requestFormId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_request_definition", + "description": "Create a provider automation target using the selected saved organization mapping. This creates a request definition through the supported provider adapter. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 262144 + }, + "folderPath": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "tenantId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "clientIdentity": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [ + "name", + "clientIdentity" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bindings", + "description": "List automation bindings, optionally for one request form. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get_binding", + "description": "Read one saved automation binding. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "binding_by_task", + "description": "Resolve the binding for one task template in one form. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "taskTemplateId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "requestFormId", + "taskTemplateId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_binding", + "description": "Bind a form task template to a provider request definition through a saved connection. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "systemConnectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "requestFormId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "taskTemplateId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "orchestrationRequestDefinitionId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "orchestrationRequestDefinitionName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "orchestrationJobDefinitionId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "orchestrationJobDefinitionName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [ + "requestFormId", + "taskTemplateId", + "orchestrationRequestDefinitionId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_binding", + "description": "Update or enable/disable an existing automation binding. Omitted properties retain their current values; explicit clear fields remove optional values. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "systemConnectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "orchestrationRequestDefinitionId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "orchestrationRequestDefinitionName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearOrchestrationRequestDefinitionName": { + "type": [ + "boolean", + "null" + ] + }, + "orchestrationJobDefinitionId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearOrchestrationJobDefinitionId": { + "type": [ + "boolean", + "null" + ] + }, + "orchestrationJobDefinitionName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearOrchestrationJobDefinitionName": { + "type": [ + "boolean", + "null" + ] + }, + "syncState": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + 3, + null + ] + }, + "lastSyncHash": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearLastSyncHash": { + "type": [ + "boolean", + "null" + ] + }, + "lastSyncVersion": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearLastSyncVersion": { + "type": [ + "boolean", + "null" + ] + }, + "lastSyncedAtUtc": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "clearLastSyncedAtUtc": { + "type": [ + "boolean", + "null" + ] + }, + "lastSyncDirection": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearLastSyncDirection": { + "type": [ + "boolean", + "null" + ] + }, + "lastReviewedDriftAtUtc": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "clearLastReviewedDriftAtUtc": { + "type": [ + "boolean", + "null" + ] + }, + "lastCorrelationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "clearLastCorrelationId": { + "type": [ + "boolean", + "null" + ] + }, + "enabled": { + "type": [ + "boolean", + "null" + ] + } + }, + "required": [] + } + }, + "required": [ + "bindingId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_binding", + "description": "Delete one automation binding. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "sync_binding_inputs", + "description": "Synchronize the form task inputs with its bound automation target. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "refresh_binding_drift", + "description": "Refresh provider schema drift for saved bindings, optionally limited to a form. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "mark_binding_import_pending", + "description": "Mark a binding for explicit reviewed schema import. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "binding_drift_preview", + "description": "Compare the saved form inputs and provider target schema before importing. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "import_binding_inputs", + "description": "Import the bound provider input definitions into the form task template. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "bindingId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "bindingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "approver_candidates", + "description": "Find designated user/customer approval candidates for a self-service task template. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "my_task_approval", + "description": "Read the caller\u0027s assigned approval. Even an owner grant cannot impersonate another designated approver. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "taskId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "approve_task", + "description": "Approve the caller\u0027s own assigned pending task before its deadline; resumes the workflow. Repeating the same accepted decision is idempotent. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "taskId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "reject_task", + "description": "Reject the caller\u0027s own assigned pending task with a reason through the canonical cancellation and notification lifecycle. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "reason": { + "type": "string", + "maxLength": 1000, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "reason" + ] + } + }, + "required": [ + "taskId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "workflow_timeline", + "description": "Read independently persisted request workflow events, including provider execution identities and effects. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + }, + "includePayload": { + "type": [ + "boolean", + "null" + ] + }, + "correlationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "categories": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "sinceUtc": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "requestId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "requestId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "overdue_tasks", + "description": "Read bounded workflow operational evidence and pending recovery work. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "escalated_tasks", + "description": "Read bounded workflow operational evidence and pending recovery work. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "pending_retries", + "description": "Read bounded workflow operational evidence and pending recovery work. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "critical_failures", + "description": "Read bounded workflow operational evidence and pending recovery work. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + }, + "sinceUtc": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "callback_rejections", + "description": "Read bounded workflow operational evidence and pending recovery work. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + }, + "lookbackDays": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 30 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "binding_issues", + "description": "Read bounded workflow operational evidence and pending recovery work. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 10000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "workflow_metrics", + "description": "Read organization-filtered workflow operational counters as Prometheus text. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "rules", + "description": "List saved automation rules with their trigger, conditions and actions. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get_rule", + "description": "Read one saved automation rule before editing or deleting it. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_rule", + "description": "Create an automation rule through the same canonical API as the administration screen. Conditions and actions retain the API\u0027s text representation; this operation saves the rule and does not claim a provider execution. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "trigger": { + "type": "string", + "maxLength": 1000, + "minLength": 1, + "pattern": "\\S" + }, + "conditions": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "actions": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + } + }, + "required": [ + "name", + "trigger" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_rule", + "description": "Replace the selected rule\u0027s name, trigger, conditions and actions. Read the current rule first; explicitly supply null conditions/actions to clear them. The route determines the stored identifier. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "trigger": { + "type": "string", + "maxLength": 1000, + "minLength": 1, + "pattern": "\\S" + }, + "conditions": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + }, + "actions": { + "type": [ + "string", + "null" + ], + "maxLength": 65536 + } + }, + "required": [ + "name", + "trigger", + "conditions", + "actions" + ] + } + }, + "required": [ + "ruleId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_rule", + "description": "Delete exactly one selected automation rule. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_capabilities", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "Read the supported catalog revision and safety policy. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_categories", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "list operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "enum": [ + "Service", + "Incident", + "Request", + "Change", + 0, + 1, + 2, + 3 + ] + }, + "search": { + "type": "string", + "maxLength": 120 + }, + "ids": { + "type": "string", + "minLength": 1 + }, + "take": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "allScopes": { + "type": "boolean" + }, + "includeInactive": { + "type": "boolean" + } + }, + "required": [], + "description": "ListRequest for helpdesk_categories operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_changes", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "get changes. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeRequest for helpdesk_changes operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "timeline", + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeRequest for helpdesk_changes operation timeline. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "worklogs", + "description": "worklogs changes. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeRequest for helpdesk_changes operation worklogs. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "timeline_count", + "description": "Read timeline_count for one change. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeCountRequest for helpdesk_changes operation timeline_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "attachments_count", + "description": "Read attachments_count for one change. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeCountRequest for helpdesk_changes operation attachments_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "listeners_count", + "description": "Read listeners_count for one change. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeCountRequest for helpdesk_changes operation listeners_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create", + "description": "create changes. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "requestedForUserId": { + "type": "string", + "minLength": 1 + }, + "implementorUserId": { + "type": "string", + "minLength": 1 + }, + "approverUserIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "implementationStartAt": { + "type": "string", + "format": "date-time", + "minLength": 1 + }, + "implementationEndAt": { + "type": "string", + "format": "date-time", + "minLength": 1 + }, + "changeType": { + "type": "string", + "enum": [ + "Standard", + "Normal", + "Emergency" + ], + "minLength": 1 + }, + "changeTemplate": { + "type": "object", + "additionalProperties": false, + "properties": { + "isPreApproved": { + "type": [ + "boolean", + "null" + ] + }, + "existingRunbookReference": { + "type": [ + "string", + "null" + ] + }, + "scopeOfChange": { + "type": "string", + "minLength": 1 + }, + "affectedSystems": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "implementationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "validationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "rollbackReference": { + "type": [ + "string", + "null" + ] + }, + "riskClassification": { + "type": [ + "string", + "null" + ] + }, + "changeDescription": { + "type": [ + "string", + "null" + ] + }, + "businessJustification": { + "type": [ + "string", + "null" + ] + }, + "impactAssessment": { + "type": [ + "string", + "null" + ] + }, + "riskAssessment": { + "type": [ + "string", + "null" + ] + }, + "preChangeChecks": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": [ + "string", + "null" + ] + }, + "rollbackPlan": { + "type": [ + "string", + "null" + ] + }, + "dependencies": { + "type": "array", + "items": { + "type": "string" + } + }, + "emergencyReason": { + "type": [ + "string", + "null" + ] + }, + "businessImpactIfNotImplemented": { + "type": [ + "string", + "null" + ] + }, + "immediateRiskAssessment": { + "type": [ + "string", + "null" + ] + }, + "incidentReference": { + "type": [ + "string", + "null" + ] + }, + "postChangeValidation": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "scopeOfChange", + "affectedSystems", + "implementationSteps", + "validationSteps" + ], + "anyOf": [ + { + "required": [ + "rollbackPlan" + ], + "properties": { + "rollbackPlan": { + "type": "string", + "minLength": 1 + } + } + }, + { + "required": [ + "rollbackReference" + ], + "properties": { + "rollbackReference": { + "type": "string", + "minLength": 1 + } + } + } + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "title", + "description", + "changeType", + "changeTemplate", + "organizationId", + "requestedForUserId", + "implementorUserId", + "implementationStartAt", + "implementationEndAt" + ], + "description": "ChangeCreateRequest for helpdesk_changes operation create. All operation-specific fields belong inside this request object, never at the tool root.", + "allOf": [ + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Standard" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "isPreApproved", + "existingRunbookReference" + ], + "properties": { + "isPreApproved": { + "const": true + }, + "existingRunbookReference": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Normal" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "businessJustification", + "impactAssessment", + "riskAssessment", + "preChangeChecks", + "testingPlan" + ], + "properties": { + "businessJustification": { + "type": "string", + "minLength": 1 + }, + "impactAssessment": { + "type": "string", + "minLength": 1 + }, + "riskAssessment": { + "type": "string", + "minLength": 1 + }, + "preChangeChecks": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Emergency" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "emergencyReason", + "businessImpactIfNotImplemented", + "immediateRiskAssessment", + "postChangeValidation" + ], + "properties": { + "emergencyReason": { + "type": "string", + "minLength": 1 + }, + "businessImpactIfNotImplemented": { + "type": "string", + "minLength": 1 + }, + "immediateRiskAssessment": { + "type": "string", + "minLength": 1 + }, + "postChangeValidation": { + "type": "string", + "minLength": 1 + } + } + } + } + } + } + ] + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update", + "description": "update changes. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "lifecycleState": { + "enum": [ + "Draft", + "Submitted", + "PendingApproval", + "ApprovedForImplementation", + "ImplementationInProgress", + "ImplementedSuccess", + "ImplementedBackedOut", + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ] + }, + "requestedForUserId": { + "type": [ + "string", + "null" + ] + }, + "implementorUserId": { + "type": [ + "string", + "null" + ] + }, + "approverUserIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "implementationStartAt": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "implementationEndAt": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + }, + "changeType": { + "type": [ + "string", + "null" + ], + "enum": [ + "Standard", + "Normal", + "Emergency" + ] + }, + "changeTemplate": { + "type": [ + "object", + "null" + ], + "additionalProperties": false, + "properties": { + "isPreApproved": { + "type": [ + "boolean", + "null" + ] + }, + "existingRunbookReference": { + "type": [ + "string", + "null" + ] + }, + "scopeOfChange": { + "type": "string", + "minLength": 1 + }, + "affectedSystems": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "implementationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "validationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "rollbackReference": { + "type": [ + "string", + "null" + ] + }, + "riskClassification": { + "type": [ + "string", + "null" + ] + }, + "changeDescription": { + "type": [ + "string", + "null" + ] + }, + "businessJustification": { + "type": [ + "string", + "null" + ] + }, + "impactAssessment": { + "type": [ + "string", + "null" + ] + }, + "riskAssessment": { + "type": [ + "string", + "null" + ] + }, + "preChangeChecks": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": [ + "string", + "null" + ] + }, + "rollbackPlan": { + "type": [ + "string", + "null" + ] + }, + "dependencies": { + "type": "array", + "items": { + "type": "string" + } + }, + "emergencyReason": { + "type": [ + "string", + "null" + ] + }, + "businessImpactIfNotImplemented": { + "type": [ + "string", + "null" + ] + }, + "immediateRiskAssessment": { + "type": [ + "string", + "null" + ] + }, + "incidentReference": { + "type": [ + "string", + "null" + ] + }, + "postChangeValidation": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "scopeOfChange", + "affectedSystems", + "implementationSteps", + "validationSteps" + ], + "anyOf": [ + { + "required": [ + "rollbackPlan" + ], + "properties": { + "rollbackPlan": { + "type": "string", + "minLength": 1 + } + } + }, + { + "required": [ + "rollbackReference" + ], + "properties": { + "rollbackReference": { + "type": "string", + "minLength": 1 + } + } + } + ] + } + }, + "required": [ + "changeId" + ], + "description": "ChangeUpdateRequest for helpdesk_changes operation update. All operation-specific fields belong inside this request object, never at the tool root.", + "allOf": [ + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Standard" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "isPreApproved", + "existingRunbookReference" + ], + "properties": { + "isPreApproved": { + "const": true + }, + "existingRunbookReference": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Normal" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "businessJustification", + "impactAssessment", + "riskAssessment", + "preChangeChecks", + "testingPlan" + ], + "properties": { + "businessJustification": { + "type": "string", + "minLength": 1 + }, + "impactAssessment": { + "type": "string", + "minLength": 1 + }, + "riskAssessment": { + "type": "string", + "minLength": 1 + }, + "preChangeChecks": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Emergency" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "emergencyReason", + "businessImpactIfNotImplemented", + "immediateRiskAssessment", + "postChangeValidation" + ], + "properties": { + "emergencyReason": { + "type": "string", + "minLength": 1 + }, + "businessImpactIfNotImplemented": { + "type": "string", + "minLength": 1 + }, + "immediateRiskAssessment": { + "type": "string", + "minLength": 1 + }, + "postChangeValidation": { + "type": "string", + "minLength": 1 + } + } + } + } + } + } + ] + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete", + "description": "delete changes. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "ChangeRequest for helpdesk_changes operation delete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "state", + "description": "state changes. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + }, + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + } + }, + "required": [ + "changeId", + "newState" + ], + "description": "TicketStateRequest for helpdesk_changes operation state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "add_worklog", + "description": "add_worklog changes. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + }, + "hours": { + "type": "number", + "minimum": 0 + }, + "notes": { + "type": "string", + "minLength": 1 + }, + "isInternalNote": { + "type": "boolean" + } + }, + "required": [ + "changeId", + "hours", + "notes" + ], + "description": "TicketWorklogRequest for helpdesk_changes operation add_worklog. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "lifecycle", + "description": "lifecycle changes. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + }, + "lifecycleState": { + "enum": [ + "Draft", + "Submitted", + "PendingApproval", + "ApprovedForImplementation", + "ImplementationInProgress", + "ImplementedSuccess", + "ImplementedBackedOut", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + } + }, + "required": [ + "changeId", + "lifecycleState" + ], + "description": "ChangeLifecycleRequest for helpdesk_changes operation lifecycle. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 1000000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "includeTotal": { + "type": "boolean" + }, + "historicOnly": { + "type": "boolean" + }, + "activeOnly": { + "type": "boolean" + }, + "summaryOnly": { + "type": "boolean" + }, + "unassigned": { + "type": "boolean" + }, + "descending": { + "type": "boolean" + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "view": { + "type": "string", + "enum": [ + "all", + "active", + "historic" + ] + }, + "customerOrgId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "forId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "assigneeId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "stateValues": { + "oneOf": [ + { + "enum": [ + "Draft", + "Submitted", + "PendingApproval", + "ApprovedForImplementation", + "ImplementationInProgress", + "ImplementedSuccess", + "ImplementedBackedOut", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "Draft", + "Submitted", + "PendingApproval", + "ApprovedForImplementation", + "ImplementationInProgress", + "ImplementedSuccess", + "ImplementedBackedOut", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + } + } + ] + }, + "priority": { + "oneOf": [ + { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + } + } + ] + }, + "timeField": { + "type": "string", + "enum": [ + "updated", + "created" + ] + }, + "sort": { + "type": "string", + "enum": [ + "updated", + "created", + "trackingId", + "subject", + "priority", + "state" + ] + }, + "from": { + "type": "string", + "format": "date-time" + }, + "to": { + "type": "string", + "format": "date-time" + }, + "lifecycleState": { + "enum": [ + "Draft", + "Submitted", + "PendingApproval", + "ApprovedForImplementation", + "ImplementationInProgress", + "ImplementedSuccess", + "ImplementedBackedOut", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + } + }, + "required": [], + "description": "ListRequest for helpdesk_changes operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_create", + "description": "bulk_create operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "items": { + "type": "array", + "minItems": 1, + "maxItems": 25, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "requestedForUserId": { + "type": "string", + "minLength": 1 + }, + "implementorUserId": { + "type": "string", + "minLength": 1 + }, + "approverUserIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "implementationStartAt": { + "type": "string", + "format": "date-time", + "minLength": 1 + }, + "implementationEndAt": { + "type": "string", + "format": "date-time", + "minLength": 1 + }, + "changeType": { + "type": "string", + "enum": [ + "Standard", + "Normal", + "Emergency" + ], + "minLength": 1 + }, + "changeTemplate": { + "type": "object", + "additionalProperties": false, + "properties": { + "isPreApproved": { + "type": [ + "boolean", + "null" + ] + }, + "existingRunbookReference": { + "type": [ + "string", + "null" + ] + }, + "scopeOfChange": { + "type": "string", + "minLength": 1 + }, + "affectedSystems": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "implementationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "validationSteps": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "rollbackReference": { + "type": [ + "string", + "null" + ] + }, + "riskClassification": { + "type": [ + "string", + "null" + ] + }, + "changeDescription": { + "type": [ + "string", + "null" + ] + }, + "businessJustification": { + "type": [ + "string", + "null" + ] + }, + "impactAssessment": { + "type": [ + "string", + "null" + ] + }, + "riskAssessment": { + "type": [ + "string", + "null" + ] + }, + "preChangeChecks": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": [ + "string", + "null" + ] + }, + "rollbackPlan": { + "type": [ + "string", + "null" + ] + }, + "dependencies": { + "type": "array", + "items": { + "type": "string" + } + }, + "emergencyReason": { + "type": [ + "string", + "null" + ] + }, + "businessImpactIfNotImplemented": { + "type": [ + "string", + "null" + ] + }, + "immediateRiskAssessment": { + "type": [ + "string", + "null" + ] + }, + "incidentReference": { + "type": [ + "string", + "null" + ] + }, + "postChangeValidation": { + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "scopeOfChange", + "affectedSystems", + "implementationSteps", + "validationSteps" + ], + "anyOf": [ + { + "required": [ + "rollbackPlan" + ], + "properties": { + "rollbackPlan": { + "type": "string", + "minLength": 1 + } + } + }, + { + "required": [ + "rollbackReference" + ], + "properties": { + "rollbackReference": { + "type": "string", + "minLength": 1 + } + } + } + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "title", + "description", + "changeType", + "changeTemplate", + "organizationId", + "requestedForUserId", + "implementorUserId", + "implementationStartAt", + "implementationEndAt" + ], + "allOf": [ + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Standard" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "isPreApproved", + "existingRunbookReference" + ], + "properties": { + "isPreApproved": { + "const": true + }, + "existingRunbookReference": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Normal" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "businessJustification", + "impactAssessment", + "riskAssessment", + "preChangeChecks", + "testingPlan" + ], + "properties": { + "businessJustification": { + "type": "string", + "minLength": 1 + }, + "impactAssessment": { + "type": "string", + "minLength": 1 + }, + "riskAssessment": { + "type": "string", + "minLength": 1 + }, + "preChangeChecks": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "testingPlan": { + "type": "string", + "minLength": 1 + } + } + } + } + } + }, + { + "if": { + "required": [ + "changeType" + ], + "properties": { + "changeType": { + "const": "Emergency" + } + } + }, + "then": { + "properties": { + "changeTemplate": { + "required": [ + "emergencyReason", + "businessImpactIfNotImplemented", + "immediateRiskAssessment", + "postChangeValidation" + ], + "properties": { + "emergencyReason": { + "type": "string", + "minLength": 1 + }, + "businessImpactIfNotImplemented": { + "type": "string", + "minLength": 1 + }, + "immediateRiskAssessment": { + "type": "string", + "minLength": 1 + }, + "postChangeValidation": { + "type": "string", + "minLength": 1 + } + } + } + } + } + } + ] + } + } + }, + "required": [ + "items" + ], + "description": "ChangeBulkCreateRequest for helpdesk_changes operation bulk_create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_state", + "description": "bulk_state operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + }, + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "newState", + "ids" + ], + "description": "BulkTicketStateRequest for helpdesk_changes operation bulk_state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "assign", + "description": "assign operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "assignedToId": { + "type": [ + "string", + "null" + ], + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "TicketAssignmentRequest for helpdesk_changes operation assign. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "assign_self", + "description": "assign_self operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "agentUserEmail": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "ConfiguredAgentAssignmentRequest for helpdesk_changes operation assign_self. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "my_approval", + "description": "Read the caller\u0027s designated change approval. An owner cannot substitute another approver\u0027s identity. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "changeId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "review_approval", + "description": "Review and approve the caller\u0027s own pending change approval. The last required review advances the change to ApprovedForImplementation and queues its timeline and notifications. Signed and authenticated decisions serialize together; a repeated committed review adds no duplicate effects. On 409 read my_approval before another action. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "changeId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_config", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "show", + "description": "Read redacted configuration. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "Read an allowlisted persisted configuration value. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "key": { + "type": "string", + "enum": [ + "apiBaseUrl", + "authentikScope" + ], + "minLength": 1 + } + }, + "required": [ + "key" + ], + "description": "ConfigKeyRequest for helpdesk_config operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "set", + "description": "Set an allowlisted non-secret configuration value. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "key": { + "type": "string", + "enum": [ + "apiBaseUrl", + "authentikScope" + ], + "minLength": 1 + }, + "value": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "key", + "value" + ], + "description": "ConfigValueRequest for helpdesk_config operation set. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "unset", + "description": "Unset an allowlisted non-secret configuration value. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "key": { + "type": "string", + "enum": [ + "apiBaseUrl", + "authentikScope" + ], + "minLength": 1 + } + }, + "required": [ + "key" + ], + "description": "ConfigKeyRequest for helpdesk_config operation unset. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_connections", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "List saved system connections and their health without returning peer credentials. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "generate_pairing_code", + "description": "Generate an expiring single-use system pairing code as a sensitive result. Deliver only to the authorized peer setup workflow; exclude it from campaign evidence and logs. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "pair", + "description": "Connect to an explicitly selected peer using its supplied short-lived write-only pairing code. Reuse the same operationId when reading the result of an uncertain attempt; the canonical signed peer protocol, address validation and owner checks apply. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "address": { + "type": "string", + "maxLength": 2048, + "minLength": 1, + "pattern": "\\S" + }, + "pairingCode": { + "type": "string", + "maxLength": 32, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it.", + "minLength": 1, + "pattern": "\\S" + }, + "operationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "address", + "pairingCode", + "operationId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "directory", + "description": "Read authorized organization, customer and provider-tenant choices for a saved pair. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "pairId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "save_mapping", + "description": "Create or update a named organization/provider mapping on an existing securely paired peer. body.id must equal mappingId and body.pairId must equal pairId. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "mappingId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "pairId": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "netRatelTenantId": { + "type": "string", + "maxLength": 262144 + }, + "ratelDeskOrganizationId": { + "type": "string", + "maxLength": 262144 + }, + "ratelDeskCustomerId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "createIncidents": { + "type": "boolean" + }, + "runAutomation": { + "type": "boolean" + } + }, + "required": [ + "id", + "pairId", + "name", + "netRatelTenantId", + "ratelDeskOrganizationId", + "createIncidents", + "runAutomation" + ] + } + }, + "required": [ + "pairId", + "mappingId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "test_mapping", + "description": "Test the exact saved mapping\u0027s approved capabilities and organization binding. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "mappingId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [ + "pairId", + "mappingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_mapping", + "description": "Remove one saved named mapping from the paired systems. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "mappingId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [ + "pairId", + "mappingId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_pair", + "description": "Delete a saved pair and its mappings through the supported cleanup lifecycle. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "pairId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "netclaw_settings", + "description": "Read saved Netclaw connectivity metadata with secret-state flags. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_netclaw_settings", + "description": "Update Netclaw connectivity settings with optional write-only device-token replacement or explicit clearing. Omit the token to preserve its protected saved value. expectedRevision enforces concurrent-update detection. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedRevision": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "enabled": { + "type": "boolean" + }, + "instance": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "endpoint": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowPrivateHttp": { + "type": "boolean" + }, + "idleMinutes": { + "type": "integer", + "minimum": 1, + "maximum": 1440 + }, + "connectionCapacity": { + "type": "integer", + "minimum": 1, + "maximum": 1000 + }, + "turnInactivityTimeout": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "activityHeartbeatInterval": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "deviceToken": { + "type": [ + "string", + "null" + ], + "maxLength": 262144, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearDeviceToken": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "test_netclaw", + "description": "Test the saved Netclaw connection and authenticated session protocol. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "test_netclaw_draft", + "description": "Test an explicit Netclaw settings draft through the authenticated session protocol without saving it. Omitted deviceToken retains the saved credential only where its endpoint binding matches. Read the saved profile and revision first. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedRevision": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "enabled": { + "type": "boolean" + }, + "instance": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "endpoint": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "allowPrivateHttp": { + "type": "boolean" + }, + "idleMinutes": { + "type": "integer", + "minimum": 1, + "maximum": 1440 + }, + "connectionCapacity": { + "type": "integer", + "minimum": 1, + "maximum": 1000 + }, + "turnInactivityTimeout": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "activityHeartbeatInterval": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "deviceToken": { + "type": [ + "string", + "null" + ], + "maxLength": 262144, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearDeviceToken": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "pair_netclaw", + "description": "Exchange a supplied one-time Netclaw pairing code, save the resulting protected device credential, and verify the authenticated session. Read netclaw_settings first and supply its current expectedRevision. If older unbound conversations exist, inspect netclaw_unbound_sessions and confirm their actual historical provider with confirm_netclaw_session_owner before pairing. On conflict or uncertain verification read the saved profile; a consumed pairing code must not be blindly replayed. Native Netclaw pairing requires its PostgreSQL durable-session capability. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "pairingCode": { + "type": "string", + "maxLength": 1024, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it.", + "minLength": 1, + "pattern": "\\S" + }, + "expectedRevision": { + "type": "integer", + "minimum": 0, + "maximum": 2147483647 + }, + "endpoint": { + "type": "string", + "maxLength": 2048, + "minLength": 1, + "pattern": "\\S" + }, + "enabled": { + "type": "boolean" + }, + "instance": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "allowPrivateHttp": { + "type": "boolean" + }, + "idleMinutes": { + "type": "integer", + "minimum": 1, + "maximum": 1440 + }, + "connectionCapacity": { + "type": "integer", + "minimum": 1, + "maximum": 1000 + }, + "turnInactivityTimeout": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "activityHeartbeatInterval": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "legacyOwnershipReviewToken": { + "type": [ + "string", + "null" + ], + "maxLength": 128, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + } + }, + "required": [ + "pairingCode", + "expectedRevision", + "endpoint", + "enabled" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "netclaw_unbound_sessions", + "description": "Read the exact legacy conversation IDs, ticket and organization context that still need historical Netclaw provider ownership confirmation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "confirm_netclaw_session_owner", + "description": "Bind explicitly reviewed legacy conversation IDs to their actual historical Netclaw endpoint and instance. expectedEligibleConversations must equal the unique submitted IDs. The API compares current eligibility and commits its owner audit; reload on a conflict before submitting a new reviewed selection. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "historicalEndpoint": { + "type": "string", + "maxLength": 2048, + "minLength": 1, + "pattern": "\\S" + }, + "expectedEligibleConversations": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "conversationIds": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "minItems": 1 + }, + "historicalInstance": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "allowPrivateHttp": { + "type": "boolean" + } + }, + "required": [ + "historicalEndpoint", + "expectedEligibleConversations", + "conversationIds" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "incident_sources", + "description": "List the configured incident receiver source namespaces, organization/customer targets, enabled state and revision. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "register_incident_source", + "description": "Register a NetRatel source instance against an enabled organization/customer and an existing valid API-purpose credential. The API validates that credential\u0027s owner, organization, purpose, expiry and revocation; this operation does not issue a new credential. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "sourceInstanceId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "customerId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "credentialId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "sourceInstanceId", + "organizationId", + "customerId", + "credentialId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "set_incident_source_state", + "description": "Enable or disable a registered incident source at its currently read expectedRevision. Concurrent changes return conflict; read the source again before a reviewed update. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "namespaceId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedRevision": { + "type": "integer", + "minimum": 1, + "maximum": 9223372036854775807 + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "expectedRevision", + "isEnabled" + ] + } + }, + "required": [ + "namespaceId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "set_incident_source_credential", + "description": "Enable or disable an explicitly selected API credential binding for a source namespace at its current expectedRevision. The API verifies active credentials belong to the source organization and persists the source audit. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "credentialId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "namespaceId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedRevision": { + "type": "integer", + "minimum": 1, + "maximum": 9223372036854775807 + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "expectedRevision", + "isEnabled" + ] + } + }, + "required": [ + "credentialId", + "namespaceId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_connectivity", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "orchestration", + "description": "orchestration operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "pattern": "\\S", + "description": "Optional exact local organization with a saved eligible automation mapping. Omit for the existing unique-connection resolver." + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "description": "Optional non-empty saved SystemConnection ID. The API enforces its mapping, capability and organization; this is not an authority grant." + } + }, + "required": [], + "description": "OrchestrationSelectionRequest for helpdesk_connectivity operation orchestration. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "orchestration_jobs", + "description": "orchestration_jobs operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "pattern": "\\S", + "description": "Optional exact local organization with a saved eligible automation mapping. Omit for the existing unique-connection resolver." + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "description": "Optional non-empty saved SystemConnection ID. The API enforces its mapping, capability and organization; this is not an authority grant." + } + }, + "required": [], + "description": "OrchestrationSelectionRequest for helpdesk_connectivity operation orchestration_jobs. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "orchestration_tenants", + "description": "orchestration_tenants operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "pattern": "\\S", + "description": "Optional exact local organization with a saved eligible automation mapping. Omit for the existing unique-connection resolver." + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "description": "Optional non-empty saved SystemConnection ID. The API enforces its mapping, capability and organization; this is not an authority grant." + } + }, + "required": [], + "description": "OrchestrationSelectionRequest for helpdesk_connectivity operation orchestration_tenants. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "orchestration_request_definitions", + "description": "orchestration_request_definitions operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "pattern": "\\S", + "description": "Optional exact local organization with a saved eligible automation mapping. Omit for the existing unique-connection resolver." + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "description": "Optional non-empty saved SystemConnection ID. The API enforces its mapping, capability and organization; this is not an authority grant." + } + }, + "required": [], + "description": "OrchestrationSelectionRequest for helpdesk_connectivity operation orchestration_request_definitions. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "orchestration_bindings", + "description": "orchestration_bindings operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "orchestration_test", + "description": "orchestration_test operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "pattern": "\\S", + "description": "Optional exact local organization with a saved eligible automation mapping. Omit for the existing unique-connection resolver." + }, + "connectionId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "description": "Optional non-empty saved SystemConnection ID. The API enforces its mapping, capability and organization; this is not an authority grant." + } + }, + "required": [], + "description": "OrchestrationSelectionRequest for helpdesk_connectivity operation orchestration_test. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_customers", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "list operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [], + "description": "ListRequest for helpdesk_customers operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "get operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "CustomerRequest for helpdesk_customers operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "auth_status", + "description": "auth_status operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "customerId" + ], + "description": "CustomerRequest for helpdesk_customers operation auth_status. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_datasets", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "List datasets in the explicitly selected authorized organization. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "Read an authorized dataset definition and schema. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "datasetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create", + "description": "Create a dataset with typed columns and explicit organization scope. Non-administrators remain restricted to custom sources. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "name": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "sourceType": { + "type": "integer", + "enum": [ + 0, + 1, + 2, + 3, + 4 + ] + }, + "keyColumn": { + "type": "string", + "maxLength": 262144 + }, + "displayColumn": { + "type": "string", + "maxLength": 262144 + }, + "searchColumns": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "isActive": { + "type": "boolean" + }, + "columns": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "dataType": { + "type": "integer", + "enum": [ + 0, + 1, + 2, + 3 + ] + }, + "isKey": { + "type": "boolean" + }, + "isDisplay": { + "type": "boolean" + }, + "isSearchable": { + "type": "boolean" + }, + "sortOrder": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [] + } + } + }, + "required": [ + "organizationId", + "name" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update", + "description": "Update a dataset definition within its actual stored organization scope. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "sourceType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + 3, + 4, + null + ] + }, + "keyColumn": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "displayColumn": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "searchColumns": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "isActive": { + "type": [ + "boolean", + "null" + ] + }, + "columns": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "dataType": { + "type": "integer", + "enum": [ + 0, + 1, + 2, + 3 + ] + }, + "isKey": { + "type": "boolean" + }, + "isDisplay": { + "type": "boolean" + }, + "isSearchable": { + "type": "boolean" + }, + "sortOrder": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [] + } + } + }, + "required": [] + } + }, + "required": [ + "datasetId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete", + "description": "Delete one authorized dataset through the canonical service. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "datasetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "rows", + "description": "Read bounded, searchable dataset rows. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 500 + }, + "page": { + "type": "integer", + "minimum": 1, + "maximum": 100000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "page", + "pageSize", + "datasetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "upsert_rows", + "description": "Update up to 100 dataset rows using the authenticated operator\u0027s actual organization authority. Set deleteMissing explicitly; true removes existing rows omitted from this selected update. The separate ingestion API-key contract remains unchanged. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "deleteMissing": { + "type": "boolean" + }, + "rows": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "externalKey": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "data": { + "type": "object", + "maxProperties": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + }, + "items": { + "type": [ + "object", + "array", + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144, + "maxProperties": 100, + "maxItems": 100, + "additionalProperties": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + }, + "items": { + "type": [ + "string", + "number", + "boolean", + "null" + ], + "maxLength": 262144 + } + } + } + } + } + }, + "x-maxUtf8Bytes": 65536, + "description": "User-defined JSON columns, at most 100 keys and 64 KiB after compact wire serialization, with bounded nesting. Keys identify dataset columns, not API routes." + }, + "sourceUpdatedAtUtc": { + "type": [ + "string", + "null" + ], + "format": "date-time" + } + }, + "required": [ + "externalKey", + "data" + ] + } + } + }, + "required": [ + "rows", + "deleteMissing" + ], + "x-maxUtf8Bytes": 1048576, + "description": "At most 1 MiB of compact JSON after wire serialization; at most 100 rows. deleteMissing must be explicit: false changes only submitted rows, true is a complete replacement." + } + }, + "required": [ + "datasetId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "credentials", + "description": "Read dataset ingestion credential metadata without secret keys. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "datasetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_credential", + "description": "Create one dataset ingestion credential. Its plaintext key is returned once to this authenticated creation request; subsequent credential reads return metadata only. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [ + "name" + ] + } + }, + "required": [ + "datasetId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "revoke_credential", + "description": "Revoke one ingestion credential under the dataset\u0027s API-management authority. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "credentialId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "datasetId", + "credentialId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "graph_settings", + "description": "Read Graph dataset configuration and synchronization diagnostics without stored secrets. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "save_graph_settings", + "description": "Save Graph dataset configuration, a write-only client secret and schedule controls. Omit or leave clientSecret empty to preserve its existing protected value. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "clientId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "clientSecret": { + "type": [ + "string", + "null" + ], + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "enableUsers": { + "type": "boolean" + }, + "enableDevices": { + "type": "boolean" + }, + "enableGroups": { + "type": "boolean" + }, + "enableSharePointSites": { + "type": "boolean" + }, + "backgroundSyncEnabled": { + "type": "boolean" + }, + "backgroundSyncCronExpression": { + "type": "string", + "maxLength": 100 + } + }, + "required": [ + "organizationId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "sync_graph", + "description": "Synchronize enabled built-in datasets through the saved Graph integration. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "options", + "description": "Read authorized searchable dataset options for self-service form inputs. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 500 + }, + "page": { + "type": "integer", + "minimum": 1, + "maximum": 100000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 50 + }, + "datasetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "page", + "pageSize", + "datasetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_email_settings", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "Read saved mailbox settings with stored secrets redacted by the API. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "Read one saved mailbox configuration and its concurrency version. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "effective", + "description": "Read each organization\u0027s effective dedicated or inherited mailbox route. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "worker_status", + "description": "Read the persisted instance mailbox worker decision and deployment-level ingestion status. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "set_worker", + "description": "Persist an explicitly confirmed mailbox worker run/pause decision. Deployment-level disabled ingestion remains authoritative. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "running": { + "type": "boolean" + }, + "confirmed": { + "type": "boolean" + } + }, + "required": [ + "running", + "confirmed" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create", + "description": "Create a mailbox with explicitly supplied write-only credentials. Credential values never appear in the preview or normal readback; create does not import mail implicitly. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "displayName": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "provider": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "authentication": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "scope": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "version": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "username": { + "type": "string", + "maxLength": 254 + }, + "password": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearPassword": { + "type": "boolean" + }, + "clientSecret": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearClientSecret": { + "type": "boolean" + }, + "confirmExistingImport": { + "type": "boolean" + }, + "initialImport": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "tlsMode": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "processedFolder": { + "type": [ + "string", + "null" + ], + "maxLength": 512 + }, + "markReadAfterSuccess": { + "type": "boolean" + }, + "pollIntervalSeconds": { + "type": "integer", + "minimum": 10, + "maximum": 300 + }, + "batchSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "mailHost": { + "type": "string", + "maxLength": 253 + }, + "port": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + }, + "useSsl": { + "type": "boolean" + }, + "mailboxAddress": { + "type": "string", + "maxLength": 254, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": "string", + "maxLength": 200 + }, + "clientId": { + "type": "string", + "maxLength": 200 + }, + "mailboxFolder": { + "type": "string", + "maxLength": 512 + }, + "enabled": { + "type": "boolean" + }, + "backgroundSyncEnabled": { + "type": "boolean" + } + }, + "required": [ + "displayName", + "mailboxAddress", + "provider", + "authentication", + "scope" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update", + "description": "Save the complete mailbox configuration using the current version. Secret fields are write-only; omitted or empty values preserve saved secrets unless the corresponding clear flag is true. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "displayName": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "provider": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "authentication": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "scope": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "version": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "username": { + "type": "string", + "maxLength": 254 + }, + "password": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearPassword": { + "type": "boolean" + }, + "clientSecret": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearClientSecret": { + "type": "boolean" + }, + "confirmExistingImport": { + "type": "boolean" + }, + "initialImport": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "tlsMode": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "processedFolder": { + "type": [ + "string", + "null" + ], + "maxLength": 512 + }, + "markReadAfterSuccess": { + "type": "boolean" + }, + "pollIntervalSeconds": { + "type": "integer", + "minimum": 10, + "maximum": 300 + }, + "batchSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "mailHost": { + "type": "string", + "maxLength": 253 + }, + "port": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + }, + "useSsl": { + "type": "boolean" + }, + "mailboxAddress": { + "type": "string", + "maxLength": 254, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": "string", + "maxLength": 200 + }, + "clientId": { + "type": "string", + "maxLength": 200 + }, + "mailboxFolder": { + "type": "string", + "maxLength": 512 + }, + "enabled": { + "type": "boolean" + }, + "backgroundSyncEnabled": { + "type": "boolean" + } + }, + "required": [ + "displayName", + "mailboxAddress", + "version", + "provider", + "authentication", + "scope" + ] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "test_mailbox", + "description": "Test a saved inbound mailbox configuration and retain its test result against the saved revision. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "test_draft_mailbox", + "description": "Test explicitly supplied draft mailbox settings and write-only credentials without saving the configuration or importing mail. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "displayName": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "provider": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "authentication": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "scope": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "version": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "username": { + "type": "string", + "maxLength": 254 + }, + "password": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearPassword": { + "type": "boolean" + }, + "clientSecret": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearClientSecret": { + "type": "boolean" + }, + "confirmExistingImport": { + "type": "boolean" + }, + "initialImport": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "tlsMode": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "processedFolder": { + "type": [ + "string", + "null" + ], + "maxLength": 512 + }, + "markReadAfterSuccess": { + "type": "boolean" + }, + "pollIntervalSeconds": { + "type": "integer", + "minimum": 10, + "maximum": 300 + }, + "batchSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "mailHost": { + "type": "string", + "maxLength": 253 + }, + "port": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + }, + "useSsl": { + "type": "boolean" + }, + "mailboxAddress": { + "type": "string", + "maxLength": 254, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": "string", + "maxLength": 200 + }, + "clientId": { + "type": "string", + "maxLength": 200 + }, + "mailboxFolder": { + "type": "string", + "maxLength": 512 + }, + "enabled": { + "type": "boolean" + }, + "backgroundSyncEnabled": { + "type": "boolean" + } + }, + "required": [ + "displayName", + "mailboxAddress", + "provider", + "authentication", + "scope" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "enable", + "description": "Enable one saved mailbox through its canonical readiness and credential checks. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "disable", + "description": "Disable one saved mailbox without deleting its history or credentials. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "sync", + "description": "Queue a sync of one configured mailbox and report queued versus unavailable state. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "archive", + "description": "Archive a mailbox using its current version and explicit confirmation. This changes organization routing through the same canonical transaction used by the UI. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "version": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "confirmed": { + "type": "boolean" + } + }, + "required": [ + "version", + "confirmed" + ] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "diagnostics", + "description": "Read bounded mailbox receipt, cursor and worker diagnostics without secrets. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "retry_receipt", + "description": "Queue retry of one eligible inbound receipt. The server checks outcome eligibility and concurrent changes. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "receiptId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId", + "receiptId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "historical_preview", + "description": "Inspect 1\u201350 eligible historical mailbox messages without importing them; retain the returned receipt identities for a selected import. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "fromUnixMilliseconds": { + "type": [ + "integer", + "null" + ], + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "toUnixMilliseconds": { + "type": [ + "integer", + "null" + ], + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "count": { + "type": "integer", + "minimum": 1, + "maximum": 50 + }, + "skip": { + "type": "integer", + "minimum": 0, + "maximum": 10000 + } + }, + "required": [] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "historical_import", + "description": "Queue only the explicitly confirmed historical receipt selection. Import eligibility, duplicates and mailbox state remain server-validated. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "receiptIds": { + "type": "array", + "maxItems": 25, + "items": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "minItems": 1 + }, + "confirmed": { + "type": "boolean" + } + }, + "required": [ + "receiptIds", + "confirmed" + ] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "outgoing", + "description": "Read the mailbox\u0027s outgoing sender configuration and version with credentials redacted. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "save_outgoing", + "description": "Save complete outgoing sender configuration with optimistic concurrency. Supply smtpPassword as an empty string to retain its saved value, a new write-only value to rotate it, or clearSmtpPassword=true to remove it. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "version": { + "type": "integer", + "minimum": 0, + "maximum": 2147483647 + }, + "enabled": { + "type": "boolean" + }, + "transport": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "displayName": { + "type": "string", + "maxLength": 200 + }, + "smtpHost": { + "type": "string", + "maxLength": 253 + }, + "smtpPort": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + }, + "smtpTlsMode": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "smtpUsername": { + "type": "string", + "maxLength": 320 + }, + "smtpPassword": { + "type": "string", + "maxLength": 4096, + "writeOnly": true, + "description": "Secret input used only for this explicit configuration write. Never echoed in previews, audit records or ordinary read responses. Omit to retain the saved secret where the API supports it." + }, + "clearSmtpPassword": { + "type": "boolean" + } + }, + "required": [ + "version", + "enabled", + "transport", + "displayName", + "smtpHost", + "smtpPort", + "smtpTlsMode", + "smtpUsername", + "smtpPassword" + ] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "test_outgoing", + "description": "Test authentication of the saved outgoing transport and record the tested revision. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "mailboxId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "send_test", + "description": "Send one explicitly confirmed sample message to one recipient using the saved sender. Acceptance by the provider is reported separately from final delivery. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "mailboxId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "recipient": { + "type": "string", + "maxLength": 254, + "minLength": 1, + "pattern": "\\S" + }, + "confirmed": { + "type": "boolean" + } + }, + "required": [ + "recipient", + "confirmed" + ] + } + }, + "required": [ + "mailboxId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "rules", + "description": "List inbound routing rules for a tenant and/or mailbox. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get_rule", + "description": "Read an inbound email rule including its typed conditions and actions. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_rule", + "description": "Create a typed inbound mail rule, including authorized forwarded-sender processing; configured tenant/mailbox checks remain enforced. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "enabled": { + "type": "boolean" + }, + "priority": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "conditions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5 + ] + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "permissions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + } + }, + "required": [] + } + }, + "actions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0 + ] + }, + "actionKey": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + }, + "stopProcessing": { + "type": "boolean" + } + }, + "required": [ + "scopeType", + "name", + "enabled", + "priority", + "conditions", + "actions", + "stopProcessing" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_rule", + "description": "Replace the typed settings of one inbound email rule. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "enabled": { + "type": "boolean" + }, + "priority": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "conditions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5 + ] + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "permissions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + } + }, + "required": [] + } + }, + "actions": { + "type": [ + "array", + "null" + ], + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0 + ] + }, + "actionKey": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + }, + "stopProcessing": { + "type": "boolean" + } + }, + "required": [ + "scopeType", + "name", + "enabled", + "priority", + "conditions", + "actions", + "stopProcessing" + ] + } + }, + "required": [ + "ruleId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "enable_rule", + "description": "Enable one inbound rule after canonical binding validation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "disable_rule", + "description": "Disable one inbound rule while retaining its audit history. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "reorder_rules", + "description": "Reorder an explicitly selected distinct set of rules in one tenant/mailbox scope. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "rules": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "priority": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [] + } + } + }, + "required": [ + "rules" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "rule_audit", + "description": "Read up to 200 inbound rule processing outcomes filtered by ticket, message, tenant or mailbox. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "messageId": { + "type": [ + "string", + "null" + ], + "maxLength": 512 + }, + "ticketId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "mailboxId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "templates", + "description": "Read saved email templates. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_template", + "description": "Create a custom email template using the canonical HTML sanitizer. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "subject": { + "type": "string", + "maxLength": 998, + "minLength": 1, + "pattern": "\\S" + }, + "htmlContent": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "layoutId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [ + "name", + "subject", + "htmlContent" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_template", + "description": "Update template content while the API preserves identity and increments its version. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "templateId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "subject": { + "type": "string", + "maxLength": 998, + "minLength": 1, + "pattern": "\\S" + }, + "htmlContent": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "layoutId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [ + "name", + "subject", + "htmlContent" + ] + } + }, + "required": [ + "templateId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_template", + "description": "Delete a custom template; protected system templates remain undeletable. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "templateId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + } + }, + "required": [ + "templateId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "preview_template", + "description": "Render a saved or draft email template using a selected tenant\u0027s branding without sending a message. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "templateId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "templateName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "draftSubject": { + "type": [ + "string", + "null" + ], + "maxLength": 998 + }, + "draftHtmlContent": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "draftLayoutHtml": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "draftLayoutId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "sampleContext": { + "type": [ + "object", + "null" + ], + "additionalProperties": false, + "properties": { + "userName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "ticketRef": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "ticketLink": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "updateMessageHtml": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "updateMessageText": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "serviceName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "requestTitle": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "requestDescription": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "requestApprovalTaskName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "requestApprovalApprover": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "requestApprovalRejectionReason": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "failureReason": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "incidentRef": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "incidentLink": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "completedAt": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "resolvedAt": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeTitle": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeDescription": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeType": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changePriority": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeOrganization": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeRequestedFor": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeImplementor": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeApprovers": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeImplementationStart": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeImplementationEnd": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeApprovalLink": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeViewLink": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeCompletionState": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeScopeOfChange": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeAffectedSystems": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeImplementationSteps": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeValidationSteps": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeRollbackPlan": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "changeRollbackReference": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "organizationName": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "inviteLink": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "inviteExpiresAt": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "helpdeskUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + }, + "required": [] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "upload_template_image", + "description": "Upload one inline template image, at most 1 MiB, through the authenticated multipart endpoint and return its stored image URL. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "templateName": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "fileName": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "pattern": "^(?!\\.{1,2}$)[^/\\\\\\u0000-\\u001F\\u007F-\\u009F]\u002B$", + "examples": [ + "fixture.png" + ] + }, + "contentType": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "^image/[A-Za-z0-9!#$\u0026^_.\u002B-]\u002B$", + "examples": [ + "image/png" + ] + }, + "contentBase64": { + "type": "string", + "maxLength": 1398104, + "minLength": 1, + "pattern": "^(?:[A-Za-z0-9\u002B/]{4})*(?:[A-Za-z0-9\u002B/]{2}==|[A-Za-z0-9\u002B/]{3}=)?$", + "examples": [ + "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + ], + "description": "Base64 file bytes, 1 byte through 1 MiB after decoding. No data-URL prefix or embedded whitespace." + } + }, + "required": [ + "fileName", + "contentType", + "contentBase64" + ] + } + }, + "required": [ + "templateName", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "layouts", + "description": "Read saved email layouts, optionally scoped to an integer tenant ID. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 2147483647 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "layout_choices", + "description": "Read selectable system and current-tenant email layouts. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_layout", + "description": "Create a custom email layout with canonical HTML sanitization. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "htmlContent": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [ + "name", + "htmlContent" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_layout", + "description": "Update layout content while preserving identity and system protection. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "layoutId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "htmlContent": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + } + }, + "required": [ + "name", + "htmlContent" + ] + } + }, + "required": [ + "layoutId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_layout", + "description": "Delete one custom layout; protected system layouts remain undeletable. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "layoutId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + } + }, + "required": [ + "layoutId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_enums", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "Read enum metadata. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "ticket_state", + "description": "Read enum metadata. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "ticket_priority", + "description": "Read enum metadata. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "request_task_status", + "description": "Read enum metadata. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "change_lifecycle_state", + "description": "Read enum metadata. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_examples", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "Read operator examples. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_health", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "Read live, ready, and authenticated health. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_incidents", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "get incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentRequest for helpdesk_incidents operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "peek", + "description": "peek incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentRequest for helpdesk_incidents operation peek. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "timeline", + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentRequest for helpdesk_incidents operation timeline. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "timeline_count", + "description": "Read timeline_count for one incident. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentCountRequest for helpdesk_incidents operation timeline_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "attachments_count", + "description": "Read attachments_count for one incident. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentCountRequest for helpdesk_incidents operation attachments_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "listeners_count", + "description": "Read listeners_count for one incident. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentCountRequest for helpdesk_incidents operation listeners_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create", + "description": "create incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "customerId": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "assignedToId": { + "type": [ + "string", + "null" + ] + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "impact": { + "type": [ + "string", + "null" + ] + }, + "ccRecipients": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "requesterEmail": { + "type": [ + "string", + "null" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "title", + "description", + "organizationId", + "customerId" + ], + "description": "IncidentCreateRequest for helpdesk_incidents operation create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_create", + "description": "bulk_create incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "items": { + "type": "array", + "minItems": 1, + "maxItems": 25, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "customerId": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "assignedToId": { + "type": [ + "string", + "null" + ] + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "impact": { + "type": [ + "string", + "null" + ] + }, + "ccRecipients": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "requesterEmail": { + "type": [ + "string", + "null" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "title", + "description", + "organizationId", + "customerId" + ] + } + } + }, + "required": [ + "items" + ], + "description": "IncidentBulkCreateRequest for helpdesk_incidents operation bulk_create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update", + "description": "update incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "ccRecipients": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "assignedToId": { + "type": [ + "string", + "null" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentUpdateRequest for helpdesk_incidents operation update. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete", + "description": "delete incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "IncidentRequest for helpdesk_incidents operation delete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "state", + "description": "state incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + }, + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + } + }, + "required": [ + "incidentId", + "newState" + ], + "description": "TicketStateRequest for helpdesk_incidents operation state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_state", + "description": "bulk_state incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + }, + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "newState", + "ids" + ], + "description": "BulkTicketStateRequest for helpdesk_incidents operation bulk_state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "assign", + "description": "assign incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "assignedToId": { + "type": [ + "string", + "null" + ], + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "TicketAssignmentRequest for helpdesk_incidents operation assign. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "assign_self", + "description": "assign_self incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "agentUserEmail": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "ConfiguredAgentAssignmentRequest for helpdesk_incidents operation assign_self. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "add_worklog", + "description": "add_worklog incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + }, + "hours": { + "type": "number", + "minimum": 0 + }, + "notes": { + "type": "string", + "minLength": 1 + }, + "isInternalNote": { + "type": "boolean" + } + }, + "required": [ + "incidentId", + "hours", + "notes" + ], + "description": "IncidentWorklogRequest for helpdesk_incidents operation add_worklog. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "close", + "description": "close incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + }, + "closureNote": { + "type": "string", + "minLength": 1 + }, + "isInternalNote": { + "type": "boolean" + } + }, + "required": [ + "incidentId", + "closureNote" + ], + "description": "IncidentCloseRequest for helpdesk_incidents operation close. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 1000000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "includeTotal": { + "type": "boolean" + }, + "historicOnly": { + "type": "boolean" + }, + "activeOnly": { + "type": "boolean" + }, + "summaryOnly": { + "type": "boolean" + }, + "unassigned": { + "type": "boolean" + }, + "descending": { + "type": "boolean" + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "view": { + "type": "string", + "enum": [ + "all", + "active", + "historic" + ] + }, + "customerOrgId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "forId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "assigneeId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "stateValues": { + "oneOf": [ + { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + } + } + ] + }, + "priority": { + "oneOf": [ + { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + } + } + ] + }, + "timeField": { + "type": "string", + "enum": [ + "updated", + "created" + ] + }, + "sort": { + "type": "string", + "enum": [ + "updated", + "created", + "trackingId", + "subject", + "priority", + "state" + ] + }, + "from": { + "type": "string", + "format": "date-time" + }, + "to": { + "type": "string", + "format": "date-time" + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "excludeId": { + "type": "string", + "minLength": 1 + }, + "requesterEmail": { + "type": "string", + "minLength": 1 + } + }, + "required": [], + "description": "ListRequest for helpdesk_incidents operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "relations", + "description": "Read the current incident\u0027s duplicate and related links. Links to incidents outside the caller\u0027s visibility are excluded. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "incidentId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_relation", + "description": "Link two incidents in the same organization and copy source listeners to the target. relationType 0 means DuplicateOf and always resolves the source; 1 means RelatedTo and follows the explicit closeSourceTicket choice. Closing completes the source SLA and publishes the canonical event. Read both incidents and relations after an uncertain result before another attempt; an existing identical relation returns 409. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "targetTicketId": { + "type": "string", + "maxLength": 128, + "pattern": ".*\\S.*", + "minLength": 1 + }, + "relationType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "closeSourceTicket": { + "type": "boolean" + }, + "note": { + "type": [ + "string", + "null" + ], + "maxLength": 4000 + } + }, + "required": [ + "targetTicketId", + "relationType", + "closeSourceTicket" + ] + } + }, + "required": [ + "incidentId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_relation", + "description": "Remove the selected relationship after reading its UUID. This removes only the link; it does not reopen the source or remove listeners already copied to the target. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "relationId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + }, + "incidentId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "relationId", + "incidentId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_delete", + "description": "Permanently delete 1\u2013100 explicitly selected incidents through the canonical silent deletion action. Requesters are not notified. Check deleted and missing counts and read back the selected IDs before repeating an uncertain batch. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "minLength": 1, + "maxLength": 128, + "pattern": "\\S" + }, + "minItems": 1 + } + }, + "required": [ + "ids" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_marketing_spam", + "description": "Silently resolve 1\u2013100 explicitly selected incidents, complete their SLA, and exclude them from requester outbound email as marketing or spam. Check updated and missing counts and read back the selected incidents. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "minLength": 1, + "maxLength": 128, + "pattern": "\\S" + }, + "minItems": 1 + } + }, + "required": [ + "ids" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_logs", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "search", + "description": "Run a bounded, redacted log search. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "since": { + "type": "integer", + "minimum": 0, + "maximum": 9223372036854775807, + "description": "Sequence cursor: return records whose numeric id is greater than since. This is not a timestamp." + }, + "correlationId": { + "type": "string", + "minLength": 1, + "pattern": "\\S", + "description": "Exact stored Activity TraceId or SpanId selector; an application X-Correlation-Id is a different identifier." + }, + "contains": { + "type": "string", + "minLength": 1, + "pattern": "\\S" + }, + "level": { + "type": "string", + "enum": [ + "Trace", + "Debug", + "Information", + "Warning", + "Error", + "Critical", + "None" + ] + }, + "limit": { + "type": "integer", + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "LogSearchRequest for helpdesk_logs operation search. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "since" + ] + }, + { + "required": [ + "correlationId" + ] + }, + { + "required": [ + "contains" + ] + } + ] + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_mail", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "pending", + "description": "Search pending deliveries with bounded paging, status, recipient and organization filters. Delivery state is distinct from queue acceptance. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "search": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "status": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "sender": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "recipient": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "reason": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "from": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "to": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "sort": { + "type": "string", + "maxLength": 262144, + "pattern": "^(created|status|recipient|ticket)$" + }, + "descending": { + "type": "boolean" + }, + "page": { + "type": "integer", + "minimum": 0, + "maximum": 1000000 + }, + "pageSize": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647, + "enum": [ + 25, + 50, + 100 + ] + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "pending_count", + "description": "Read the number of failed deliveries awaiting review or retry. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "failed", + "description": "Read up to 100 failed delivery events including retry eligibility and recipient outcome evidence. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "retry", + "description": "Retry one eligible failed delivery. Uncertain, partially accepted or changed-sender deliveries require their separate reviewed retry operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "deliveryId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "outgoing_retry_preview", + "description": "Read the current outgoing revision and fence required before retrying a reviewed sender configuration. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "deliveryId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "retry_current_outgoing", + "description": "Retry using the reviewed outgoing configuration with its expected revisions and fence. Preserve the preview values in the request. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedOutgoingVersion": { + "type": "integer", + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "confirmed": { + "type": "boolean" + }, + "expectedMailboxId": { + "type": [ + "string", + "null" + ], + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "expectedMailboxVersion": { + "type": [ + "integer", + "null" + ], + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "expectedFence": { + "type": [ + "integer", + "null" + ], + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + } + }, + "required": [ + "expectedOutgoingVersion", + "expectedMailboxId", + "expectedMailboxVersion", + "expectedFence", + "confirmed" + ] + } + }, + "required": [ + "deliveryId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "uncertain_retry_preview", + "description": "Read an uncertain delivery\u0027s current fence, sender and recipients before independently establishing whether delivery occurred. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "deliveryId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "retry_confirmed_undelivered", + "description": "Retry an uncertain delivery only after independent evidence confirms no delivery. The API retains evidence, outcome and fence checks. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedFence": { + "type": "integer", + "minimum": 0, + "maximum": 9223372036854780000 + }, + "expectedOutgoingVersion": { + "type": "integer", + "minimum": 1, + "maximum": 9223372036854780000 + }, + "evidenceReference": { + "type": "string", + "maxLength": 262144, + "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]{7,127}$", + "minLength": 1 + }, + "confirmedNoDelivery": { + "type": "boolean" + } + }, + "required": [ + "evidenceReference", + "expectedFence", + "expectedOutgoingVersion", + "confirmedNoDelivery" + ] + } + }, + "required": [ + "deliveryId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "changed_route_preview", + "description": "Read the old and current sender routes and all revisions before approving a route change. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "deliveryId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "retry_current_route", + "description": "Retry with an explicitly reviewed new sender using the exact route-preview identifiers and revisions. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "deliveryId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "expectedFence": { + "type": "integer", + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "expectedOriginalMailboxId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "expectedCurrentMailboxId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "expectedMailboxVersion": { + "type": "integer", + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "expectedOutgoingVersion": { + "type": "integer", + "minimum": -9223372036854775808, + "maximum": 9223372036854775807 + }, + "confirmedNewSender": { + "type": "boolean" + } + }, + "required": [ + "expectedFence", + "expectedOriginalMailboxId", + "expectedCurrentMailboxId", + "expectedMailboxVersion", + "expectedOutgoingVersion", + "confirmedNewSender" + ] + } + }, + "required": [ + "deliveryId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "pending_organizations", + "description": "Look up organizations for pending-delivery filtering; returns at most 50 matches. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 100 + }, + "id": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "take": { + "type": "integer", + "minimum": 1, + "maximum": 50 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "pending_actions", + "description": "Apply retry, cancel or remove to 1\u2013100 explicitly selected delivery IDs with a recorded reason. The API reauthorizes and reports each result independently. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + } + }, + "minItems": 1 + }, + "action": { + "type": "string", + "maxLength": 262144, + "pattern": "^(retry|cancel|remove)$", + "minLength": 1 + }, + "reason": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "confirmed": { + "type": "boolean" + } + }, + "required": [ + "ids", + "action", + "reason", + "confirmed" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "send", + "description": "Send an administrator-authored message through the configured mail service to explicitly supplied recipients. For ticket replies use the ticket add_worklog operation with isInternalNote=false. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "recipients": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + }, + "minItems": 1 + }, + "subject": { + "type": "string", + "maxLength": 998, + "minLength": 1, + "pattern": "\\S" + }, + "htmlMessage": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "recipients", + "subject", + "htmlMessage" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "test_provider", + "description": "Test availability of the configured email provider. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_notifications", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "list operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "search": { + "type": "string" + }, + "source": { + "type": "string" + }, + "category": { + "type": "string" + }, + "sortBy": { + "type": "string" + }, + "sortDir": { + "type": "string" + }, + "severity": { + "enum": [ + "Info", + "Warning", + "Error", + "Success", + "Critical", + 0, + 1, + 2, + 3, + 4 + ] + }, + "from": { + "type": "string", + "format": "date-time" + }, + "to": { + "type": "string", + "format": "date-time" + } + }, + "required": [], + "description": "ListRequest for helpdesk_notifications operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "get operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "notificationId": { + "type": "string", + "format": "uuid", + "minLength": 1 + } + }, + "required": [ + "notificationId" + ], + "description": "NotificationRequest for helpdesk_notifications operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "summary", + "description": "Read total, unread and unread Error/Critical counts for the actor\u0027s complete authorized notification population. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "unread_errors", + "description": "unread_errors operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "take": { + "type": "integer", + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "ListRequest for helpdesk_notifications operation unread_errors. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "mark_read", + "description": "mark_read operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "ids" + ], + "description": "NotificationMarkReadRequest for helpdesk_notifications operation mark_read. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "unread", + "description": "Read one bounded page of the caller\u0027s unread notifications. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 1000000 + }, + "pageSize": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 100 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "error_summary", + "description": "Read the caller\u0027s authorized error notification counters. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "timeline", + "description": "Read persisted DomainEvent notifications for a reference, correlationId or both, with bounded output. At least one selector must contain non-whitespace text. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "reference": { + "type": [ + "string", + "null" + ], + "maxLength": 128 + }, + "correlationId": { + "type": [ + "string", + "null" + ], + "maxLength": 128 + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 128 + }, + "take": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 200 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body.", + "anyOf": [ + { + "required": [ + "reference" + ], + "properties": { + "reference": { + "type": "string", + "minLength": 1, + "pattern": "\\S" + } + } + }, + { + "required": [ + "correlationId" + ], + "properties": { + "correlationId": { + "type": "string", + "minLength": 1, + "pattern": "\\S" + } + } + } + ] + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_organizations", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "list operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [], + "description": "ListRequest for helpdesk_organizations operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "get operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "organizationId" + ], + "description": "OrganizationRequest for helpdesk_organizations operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "tenants", + "description": "tenants operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "tenant_lookup", + "description": "tenant_lookup operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "change_participants", + "description": "change_participants operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "organizationId" + ], + "description": "OrganizationRequest for helpdesk_organizations operation change_participants. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_raw", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "system_version", + "description": "system_version operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get_incident", + "description": "get_incident operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "incidentId" + ], + "description": "AllowlistedReadRequest for helpdesk_raw operation get_incident. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get_request", + "description": "get_request operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "AllowlistedReadRequest for helpdesk_raw operation get_request. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get_change", + "description": "get_change operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "changeId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "changeId" + ], + "description": "AllowlistedReadRequest for helpdesk_raw operation get_change. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_request_forms", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "Get one request form. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestFormId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestFormId" + ], + "description": "RequestFormRequest for helpdesk_request_forms operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "by_service", + "description": "List forms for a service. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "serviceId" + ], + "description": "RequestFormsByServiceRequest for helpdesk_request_forms operation by_service. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_request_tasks", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 1000000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "includeTotal": { + "type": "boolean" + }, + "historicOnly": { + "type": "boolean" + }, + "assignedToId": { + "type": "string", + "minLength": 1 + }, + "requestId": { + "type": "string", + "minLength": 1 + }, + "serviceId": { + "type": "string", + "minLength": 1 + }, + "assignedToMe": { + "type": "boolean" + }, + "status": { + "enum": [ + "Pending", + "InProgress", + "Completed", + "Failed", + "Skipped", + "PendingApproval", + "Cancelled", + 1, + 2, + 3, + 4, + 5, + 6, + 7 + ] + }, + "type": { + "enum": [ + "Manual", + "Automation", + "Approval", + 1, + 2, + 3 + ] + } + }, + "required": [], + "description": "ListRequest for helpdesk_request_tasks operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "get operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create", + "description": "create operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "requestId": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "customerId": { + "type": [ + "string", + "null" + ], + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "linkedAssetIds": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "attachments": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "dueDate": { + "type": "string", + "format": "date-time" + } + }, + "required": [ + "title", + "description", + "requestId", + "organizationId" + ], + "description": "RequestTaskCreateRequest for helpdesk_request_tasks operation create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update", + "description": "update operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + }, + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "assignedToId": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "linkedAssetIds": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "attachments": { + "type": "array", + "minItems": 0, + "items": { + "type": "string", + "minLength": 1 + } + }, + "dueDate": { + "type": "string", + "format": "date-time" + }, + "clearAssignment": { + "type": "boolean" + }, + "clearDueDate": { + "type": "boolean" + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskUpdateRequest for helpdesk_request_tasks operation update. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "title" + ], + "properties": {} + }, + { + "required": [ + "description" + ], + "properties": {} + }, + { + "required": [ + "priority" + ], + "properties": {} + }, + { + "required": [ + "assignedToId" + ], + "properties": {} + }, + { + "required": [ + "linkedAssetIds" + ], + "properties": {} + }, + { + "required": [ + "attachments" + ], + "properties": {} + }, + { + "required": [ + "dueDate" + ], + "properties": {} + }, + { + "required": [ + "clearAssignment" + ], + "properties": { + "clearAssignment": { + "const": true + } + } + }, + { + "required": [ + "clearDueDate" + ], + "properties": { + "clearDueDate": { + "const": true + } + } + } + ], + "allOf": [ + { + "not": { + "required": [ + "clearAssignment", + "assignedToId" + ], + "properties": { + "clearAssignment": { + "const": true + } + } + } + }, + { + "not": { + "required": [ + "clearDueDate", + "dueDate" + ], + "properties": { + "clearDueDate": { + "const": true + } + } + } + } + ] + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete", + "description": "delete operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation delete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "start", + "description": "start operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation start. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "complete", + "description": "complete operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation complete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "fail", + "description": "fail operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation fail. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "retry", + "description": "retry operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "taskId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "taskId" + ], + "description": "RequestTaskRequest for helpdesk_request_tasks operation retry. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_start", + "description": "bulk_start operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "ids" + ], + "description": "BulkRequestTaskActionRequest for helpdesk_request_tasks operation bulk_start. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_complete", + "description": "bulk_complete operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "ids" + ], + "description": "BulkRequestTaskActionRequest for helpdesk_request_tasks operation bulk_complete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_retry", + "description": "bulk_retry operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "ids" + ], + "description": "BulkRequestTaskActionRequest for helpdesk_request_tasks operation bulk_retry. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_requests", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "get requests. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestRequest for helpdesk_requests operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "tasks", + "description": "tasks requests. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestRequest for helpdesk_requests operation tasks. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "timeline", + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestRequest for helpdesk_requests operation timeline. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "timeline_count", + "description": "Read timeline_count for one request. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestCountRequest for helpdesk_requests operation timeline_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "attachments_count", + "description": "Read attachments_count for one request. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestCountRequest for helpdesk_requests operation attachments_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "listeners_count", + "description": "Read listeners_count for one request. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestCountRequest for helpdesk_requests operation listeners_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create", + "description": "create requests. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "customerId": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "assignedToId": { + "type": [ + "string", + "null" + ] + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "category": { + "type": [ + "string", + "null" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + }, + "serviceId": { + "type": [ + "string", + "null" + ] + }, + "requestFormId": { + "type": [ + "string", + "null" + ] + }, + "payloadJson": { + "type": [ + "string", + "null" + ] + }, + "requesterEmail": { + "type": [ + "string", + "null" + ] + }, + "ccRecipients": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "description", + "title", + "organizationId", + "customerId" + ], + "description": "RequestCreateRequest for helpdesk_requests operation create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update", + "description": "update requests. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + } + }, + "required": [ + "requestId" + ], + "description": "RequestUpdateRequest for helpdesk_requests operation update. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete", + "description": "delete requests. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestRequest for helpdesk_requests operation delete. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "state", + "description": "state requests. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + }, + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + } + }, + "required": [ + "requestId", + "newState" + ], + "description": "TicketStateRequest for helpdesk_requests operation state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "add_worklog", + "description": "add_worklog requests. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + }, + "hours": { + "type": "number", + "minimum": 0 + }, + "notes": { + "type": "string", + "minLength": 1 + }, + "isInternalNote": { + "type": "boolean" + } + }, + "required": [ + "requestId", + "hours", + "notes" + ], + "description": "TicketWorklogRequest for helpdesk_requests operation add_worklog. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 1000000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "query": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200, + "description": "Search sent as API q. query/q aliases accept null or blank as unfiltered; equivalent trimmed values deduplicate; conflicting nonempty values reject. Filtering precedes totals and paging." + }, + "includeTotal": { + "type": "boolean" + }, + "historicOnly": { + "type": "boolean" + }, + "activeOnly": { + "type": "boolean" + }, + "summaryOnly": { + "type": "boolean" + }, + "unassigned": { + "type": "boolean" + }, + "descending": { + "type": "boolean" + }, + "state": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "view": { + "type": "string", + "enum": [ + "all", + "active", + "historic" + ] + }, + "customerOrgId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "forId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "assigneeId": { + "oneOf": [ + { + "type": "string", + "minLength": 1 + }, + { + "type": "array", + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1 + } + } + ] + }, + "stateValues": { + "oneOf": [ + { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + } + } + ] + }, + "priority": { + "oneOf": [ + { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + }, + { + "type": "array", + "maxItems": 20, + "items": { + "enum": [ + "Low", + "Medium", + "High", + "Critical", + 0, + 1, + 2, + 3 + ] + } + } + ] + }, + "timeField": { + "type": "string", + "enum": [ + "updated", + "created" + ] + }, + "sort": { + "type": "string", + "enum": [ + "updated", + "created", + "trackingId", + "subject", + "priority", + "state" + ] + }, + "from": { + "type": "string", + "format": "date-time" + }, + "to": { + "type": "string", + "format": "date-time" + }, + "aiOnly": { + "type": "boolean" + } + }, + "required": [], + "description": "ListRequest for helpdesk_requests operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_create", + "description": "bulk_create operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "items": { + "type": "array", + "minItems": 1, + "maxItems": 25, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "title": { + "type": "string", + "minLength": 1 + }, + "description": { + "type": "string", + "minLength": 1 + }, + "priority": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High", + "Critical" + ] + }, + "customerId": { + "type": "string", + "minLength": 1 + }, + "organizationId": { + "type": "string", + "minLength": 1 + }, + "assignedToId": { + "type": [ + "string", + "null" + ] + }, + "linkedAssetIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "attachments": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + }, + "dueDate": { + "type": [ + "string", + "null" + ], + "format": "date-time" + }, + "category": { + "type": [ + "string", + "null" + ] + }, + "categoryIds": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string", + "format": "uuid" + } + }, + "serviceId": { + "type": [ + "string", + "null" + ] + }, + "requestFormId": { + "type": [ + "string", + "null" + ] + }, + "payloadJson": { + "type": [ + "string", + "null" + ] + }, + "requesterEmail": { + "type": [ + "string", + "null" + ] + }, + "ccRecipients": { + "type": [ + "array", + "null" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "description", + "title", + "organizationId", + "customerId" + ] + } + } + }, + "required": [ + "items" + ], + "description": "RequestBulkCreateRequest for helpdesk_requests operation bulk_create. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bulk_state", + "description": "bulk_state operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "newState": { + "enum": [ + "New", + "WaitingReply", + "Replied", + "InProgress", + "PendingApproval", + "OnHold", + "Resolved", + 0, + 1, + 2, + 3, + 4, + 5, + 6 + ] + }, + "comment": { + "type": "string" + }, + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + } + }, + "required": [ + "newState", + "ids" + ], + "description": "BulkTicketStateRequest for helpdesk_requests operation bulk_state. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "assign", + "description": "assign operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "assignedToId": { + "type": [ + "string", + "null" + ], + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "TicketAssignmentRequest for helpdesk_requests operation assign. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "assign_self", + "description": "assign_self operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "agentUserEmail": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ids" + ], + "description": "ConfiguredAgentAssignmentRequest for helpdesk_requests operation assign_self. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_roles", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "list operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [], + "description": "ListRequest for helpdesk_roles operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "get operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "roleId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "roleId" + ], + "description": "RoleRequest for helpdesk_roles operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_schema", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "Read the executable MCP operation catalog. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_search", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "users", + "description": "users operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": "string", + "minLength": 1 + }, + "q": { + "type": "string", + "minLength": 1 + }, + "limit": { + "type": "integer", + "minimum": 1, + "maximum": 25, + "description": "Alias of pageSize; bounded result count, maximum25. TotalCount describes returned bounded rows, not full filtered dataset." + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 25 + } + }, + "required": [], + "description": "SearchRequest for helpdesk_search operation users. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "query" + ] + }, + { + "required": [ + "q" + ] + } + ] + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "customers", + "description": "customers operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": "string", + "minLength": 1 + }, + "q": { + "type": "string", + "minLength": 1 + }, + "limit": { + "type": "integer", + "minimum": 1, + "maximum": 25, + "description": "Alias of pageSize; bounded result count, maximum25. TotalCount describes returned bounded rows, not full filtered dataset." + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 25 + } + }, + "required": [], + "description": "SearchRequest for helpdesk_search operation customers. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "query" + ] + }, + { + "required": [ + "q" + ] + } + ] + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "organizations", + "description": "organizations operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": "string", + "minLength": 1 + }, + "q": { + "type": "string", + "minLength": 1 + }, + "limit": { + "type": "integer", + "minimum": 1, + "maximum": 25, + "description": "Alias of pageSize; bounded result count, maximum25. TotalCount describes returned bounded rows, not full filtered dataset." + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 25 + } + }, + "required": [], + "description": "SearchRequest for helpdesk_search operation organizations. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "query" + ] + }, + { + "required": [ + "q" + ] + } + ] + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_self_service", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "requests", + "description": "requests operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "q": { + "type": "string" + } + }, + "required": [], + "description": "ListRequest for helpdesk_self_service operation requests. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "request_users", + "description": "request_users operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "query": { + "type": "string" + } + }, + "required": [], + "description": "ListRequest for helpdesk_self_service operation request_users. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get_request", + "description": "get_request operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "requestId" + ], + "description": "RequestRequest for helpdesk_self_service operation get_request. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_services", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "list operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [], + "description": "ListRequest for helpdesk_services operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "get operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "serviceId" + ], + "description": "ServiceRequest for helpdesk_services operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "items", + "description": "items operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "serviceId" + ], + "description": "ServiceRequest for helpdesk_services operation items. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "search_items", + "description": "search_items operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "query": { + "type": "string", + "minLength": 1 + }, + "q": { + "type": "string", + "minLength": 1 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 25 + }, + "includeTotal": { + "type": "boolean" + } + }, + "required": [], + "description": "SearchRequest for helpdesk_services operation search_items. All operation-specific fields belong inside this request object, never at the tool root.", + "anyOf": [ + { + "required": [ + "query" + ] + }, + { + "required": [ + "q" + ] + } + ] + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "breadcrumb", + "description": "breadcrumb operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "serviceId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "serviceId" + ], + "description": "ServiceRequest for helpdesk_services operation breadcrumb. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_sla", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "policies", + "description": "Read SLA policies and escalation rules. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_policy", + "description": "Create an SLA policy with its scope, matching rules, deadlines and escalations. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "appliesTo": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "priority": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "serviceId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "matchRank": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "responseTimeHours": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "resolutionTimeHours": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "autoResumeAfterHours": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "isActive": { + "type": "boolean" + }, + "escalations": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "metric": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "triggerPercent": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "recipients": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "targets": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "value": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [] + } + }, + "isActive": { + "type": "boolean" + }, + "note": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + } + }, + "required": [ + "name" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_policy", + "description": "Update an existing SLA policy using canonical validation and audit events. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "policyId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "appliesTo": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "priority": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "serviceId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "matchRank": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "responseTimeHours": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "resolutionTimeHours": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "autoResumeAfterHours": { + "type": [ + "integer", + "null" + ], + "minimum": -2147483648, + "maximum": 2147483647 + }, + "isActive": { + "type": "boolean" + }, + "escalations": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "metric": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "triggerPercent": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "recipients": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + }, + "targets": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "value": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [] + } + }, + "isActive": { + "type": "boolean" + }, + "note": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + } + }, + "required": [ + "name" + ] + } + }, + "required": [ + "policyId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_policy", + "description": "Delete a selected SLA policy. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "policyId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "policyId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "calendars", + "description": "Read business calendars, weekly hours and date exceptions. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_calendar", + "description": "Create a validated business-hours calendar. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "timeZoneId": { + "type": "string", + "maxLength": 262144 + }, + "weeklyRules": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "dayOfWeek": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "isWorkingDay": { + "type": "boolean" + }, + "workingHours": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "start": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "end": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + } + }, + "required": [] + } + } + }, + "required": [] + } + }, + "exceptions": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "date": { + "type": "string", + "format": "date" + }, + "isWorkingDayOverride": { + "type": "boolean" + }, + "workingHoursOverride": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "start": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "end": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + } + }, + "required": [] + } + }, + "note": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + }, + "isActive": { + "type": "boolean" + } + }, + "required": [ + "name", + "timeZoneId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_calendar", + "description": "Update calendar rules and exceptions. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "calendarId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "scopeType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "name": { + "type": "string", + "maxLength": 262144 + }, + "timeZoneId": { + "type": "string", + "maxLength": 262144 + }, + "weeklyRules": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "dayOfWeek": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "isWorkingDay": { + "type": "boolean" + }, + "workingHours": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "start": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "end": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + } + }, + "required": [] + } + } + }, + "required": [] + } + }, + "exceptions": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "date": { + "type": "string", + "format": "date" + }, + "isWorkingDayOverride": { + "type": "boolean" + }, + "workingHoursOverride": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "start": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "end": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + } + }, + "required": [] + } + }, + "note": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [] + } + }, + "isActive": { + "type": "boolean" + } + }, + "required": [ + "name", + "timeZoneId" + ] + } + }, + "required": [ + "calendarId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_calendar", + "description": "Delete a selected calendar subject to canonical usage constraints. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "calendarId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "calendarId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "tenant_settings", + "description": "Read one tenant\u0027s business-hours and calendar selection. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "tenantId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "save_tenant_settings", + "description": "Save the selected tenant\u0027s business-hours and calendar settings. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "tenantId": { + "type": "string", + "maxLength": 262144 + }, + "useBusinessHours": { + "type": "boolean" + }, + "calendarId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [ + "useBusinessHours" + ] + } + }, + "required": [ + "tenantId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "report_subscriptions", + "description": "Read scheduled SLA reports and recipients. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_report_subscription", + "description": "Create an SLA report schedule with explicit recipients and tenant scope. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "tenantId": { + "type": "string", + "maxLength": 262144 + }, + "isActive": { + "type": "boolean" + }, + "frequency": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "weeklyDay": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "sendTimeLocal": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "timeZoneId": { + "type": "string", + "maxLength": 262144 + }, + "targets": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "value": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [] + } + }, + "lookbackDays": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "includeCsvAttachment": { + "type": "boolean" + }, + "includeExcelAttachment": { + "type": "boolean" + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + }, + "serviceId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [ + "tenantId", + "frequency", + "sendTimeLocal", + "timeZoneId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_report_subscription", + "description": "Update or disable an SLA report schedule. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "subscriptionId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "string", + "maxLength": 262144 + }, + "tenantId": { + "type": "string", + "maxLength": 262144 + }, + "isActive": { + "type": "boolean" + }, + "frequency": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "weeklyDay": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + null + ] + }, + "sendTimeLocal": { + "type": "string", + "maxLength": 26, + "format": "time-span", + "pattern": "^-?(\\d\u002B\\.)?([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d{1,7})?$", + "examples": [ + "09:00:00" + ] + }, + "timeZoneId": { + "type": "string", + "maxLength": 262144 + }, + "targets": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "type": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "value": { + "type": "string", + "maxLength": 262144 + } + }, + "required": [] + } + }, + "lookbackDays": { + "type": "integer", + "minimum": -2147483648, + "maximum": 2147483647 + }, + "includeCsvAttachment": { + "type": "boolean" + }, + "includeExcelAttachment": { + "type": "boolean" + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + }, + "serviceId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + } + }, + "required": [ + "tenantId", + "frequency", + "sendTimeLocal", + "timeZoneId" + ] + } + }, + "required": [ + "subscriptionId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_report_subscription", + "description": "Remove one SLA report schedule. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "subscriptionId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "subscriptionId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "compliance", + "description": "Read SLA compliance for a declared period and ticket type. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "fromUtc": { + "type": "string", + "format": "date-time", + "minLength": 1, + "pattern": "\\S" + }, + "toUtc": { + "type": "string", + "format": "date-time", + "minLength": 1, + "pattern": "\\S" + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + } + }, + "required": [ + "fromUtc", + "toUtc" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "breached", + "description": "Read a page of breached open tickets. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 100000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + } + }, + "required": [ + "page", + "pageSize" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "near_breach", + "description": "Read a page of tickets approaching the selected SLA threshold. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "page": { + "type": "integer", + "minimum": 1, + "maximum": 100000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "thresholdPercent": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "metric": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + } + }, + "required": [ + "page", + "pageSize", + "thresholdPercent", + "metric" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "completed", + "description": "Read completed ticket SLA outcomes for a declared period. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "fromUtc": { + "type": "string", + "format": "date-time", + "minLength": 1, + "pattern": "\\S" + }, + "toUtc": { + "type": "string", + "format": "date-time", + "minLength": 1, + "pattern": "\\S" + }, + "page": { + "type": "integer", + "minimum": 1, + "maximum": 100000 + }, + "pageSize": { + "type": "integer", + "minimum": 1, + "maximum": 100 + }, + "tenantId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "ticketType": { + "type": [ + "integer", + "null" + ], + "enum": [ + 0, + 1, + 2, + null + ] + }, + "withinResolutionSla": { + "type": [ + "boolean", + "null" + ] + } + }, + "required": [ + "fromUtc", + "toUtc", + "page", + "pageSize" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "pause_ticket", + "description": "Pause one eligible ticket SLA with a recorded reason; parent ticket authorization is enforced. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "reason": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "reason" + ] + } + }, + "required": [ + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "resume_ticket", + "description": "Resume one eligible ticket SLA through its canonical lifecycle. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [] + } + }, + "required": [ + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_support", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "groups", + "description": "List support groups, optionally for one owning organization. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "owningOrganizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get_group", + "description": "Read one support group. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "groupId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_group", + "description": "Create a support group in its owning organization. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "owningOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "name": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "owningOrganizationId", + "name" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_group", + "description": "Update support group metadata and enabled status. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "owningOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "name": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "description": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "owningOrganizationId", + "name" + ] + } + }, + "required": [ + "groupId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_group", + "description": "Delete one support group through the canonical repository rules. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "groupId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "members", + "description": "List the selected support group\u0027s members and enabled state. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "groupId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "add_member", + "description": "Add an existing user to the selected support group with explicit membership role and source. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "role": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "source": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "userId" + ] + } + }, + "required": [ + "groupId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_member", + "description": "Update or disable an existing membership; the API verifies that it belongs to the selected group. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "memberId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "role": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "source": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [] + } + }, + "required": [ + "groupId", + "memberId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "remove_member", + "description": "Remove one membership from its verified group. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "groupId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "memberId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "groupId", + "memberId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "coverage", + "description": "List customer-to-provider support coverage routes. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_coverage", + "description": "Create explicit customer, provider and group coverage with a primary or backup role. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "providerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "supportGroupId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "role": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "customerOrganizationId", + "providerOrganizationId", + "supportGroupId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_coverage", + "description": "Update or disable a saved support coverage route. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "coverageId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "providerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "supportGroupId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "role": { + "type": "integer", + "enum": [ + 0, + 1, + 2 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "customerOrganizationId", + "providerOrganizationId", + "supportGroupId" + ] + } + }, + "required": [ + "coverageId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_coverage", + "description": "Delete one explicitly selected support coverage route. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "coverageId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "coverageId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "subscriptions", + "description": "List support notification subscriptions for one or all customer organizations. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + } + }, + "required": [], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_subscription", + "description": "Create an explicit event and recipient subscription; only configured supported delivery channels are accepted. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "eventType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "recipientType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "recipientId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "channel": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "customerOrganizationId", + "recipientId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_subscription", + "description": "Update or disable one support notification subscription. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "subscriptionId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerOrganizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "eventType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "recipientType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "recipientId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "channel": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [ + "customerOrganizationId", + "recipientId" + ] + } + }, + "required": [ + "subscriptionId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_subscription", + "description": "Delete one support notification subscription. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "subscriptionId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "subscriptionId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "my_preferences", + "description": "Read the authenticated caller\u0027s own support notification preferences. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "set_my_preference", + "description": "Update one of the authenticated caller\u0027s preferences; the server selects the caller identity. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "eventType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "channel": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "user_preferences", + "description": "Read one selected user\u0027s notification preferences under administrator authority. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "set_user_preference", + "description": "Update a selected user\u0027s preference under administrator authority; the route determines the target user. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "eventType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "channel": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "isEnabled": { + "type": "boolean" + } + }, + "required": [] + } + }, + "required": [ + "userId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "recipient_preview", + "description": "Resolve the actual recipients for one organization event without sending mail. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "eventType": { + "type": "integer", + "enum": [ + 0, + 1 + ] + }, + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "eventType", + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "bootstrap_defaults", + "description": "Ensure the instance\u0027s default support configuration using the canonical idempotent bootstrapper. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_system", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "version", + "description": "Read safe system metadata. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_tenant_admin", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "organizations", + "description": "List the organizations the caller can administer. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "settings", + "description": "Read one organization\u0027s display and contact settings. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_settings", + "description": "Update one organization\u0027s display and contact settings. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "contactInfo": { + "type": [ + "string", + "null" + ], + "maxLength": 4000 + } + }, + "required": [ + "name" + ] + } + }, + "required": [ + "organizationId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "members", + "description": "List local team members and their scoped role assignments. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delegable_roles", + "description": "List operational built-in and tenant-owned roles that may be delegated in this organization. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "organizationId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "assignments", + "description": "Read the selected local user\u0027s role assignments within this organization. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "organizationId", + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "replace_assignments", + "description": "Replace the selected local user\u0027s delegable role assignments; an empty list removes those assignments. Other scopes and instance-admin authority remain governed by the API. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "roleKeys": { + "type": "array", + "maxItems": 100, + "items": { + "type": "string", + "maxLength": 262144 + } + } + }, + "required": [ + "roleKeys" + ] + } + }, + "required": [ + "organizationId", + "userId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_local_account", + "description": "Create a local account and return its newly issued one-time activation token as an explicitly sensitive result. This does not read an existing password. Deliver the token only through the authorized private activation workflow. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "displayName": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "email": { + "type": "string", + "maxLength": 254, + "minLength": 1, + "pattern": "\\S" + }, + "isInstanceAdministrator": { + "type": "boolean" + }, + "role": { + "type": "string", + "maxLength": 262144, + "enum": [ + "User", + "Technician" + ] + }, + "organizationId": { + "type": [ + "string", + "null" + ], + "maxLength": 262144 + }, + "isTestUser": { + "type": "boolean" + } + }, + "required": [ + "displayName", + "email" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "reset_local_account", + "description": "Issue a new one-time local-account activation token as an explicitly sensitive result; preserve it only through the authorized private activation workflow. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "reset_customer_login", + "description": "Issue a new one-time activation token for the customer\u0027s single linked enabled local account. Inspect helpdesk_customers.auth_status first; external customer invite/resend/sync flows have their separate identity-provider contract. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "customerId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "local_account_status", + "description": "Read a local account\u0027s enabled status. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "disable_local_account", + "description": "Disable a local account through the existing administrator lifecycle, including session/credential invalidation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "enable_local_account", + "description": "Enable a disabled local account. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "local_account_assignments", + "description": "Read all scoped role assignments and local/instance-administrator flags for one account. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "userId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "replace_local_account_assignments", + "description": "Replace the selected non-instance-admin account\u0027s explicit scoped role assignments; each role and organization is validated by the API. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "assignments": { + "type": "array", + "maxItems": 100, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "roleKey": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + }, + "organizationId": { + "type": "string", + "maxLength": 262144, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "roleKey", + "organizationId" + ] + } + } + }, + "required": [ + "assignments" + ] + } + }, + "required": [ + "userId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "assets", + "description": "List asset records visible to the authorized instance administrator. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get_asset", + "description": "Read the selected asset and its saved organization before editing. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "assetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "assetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "create_asset", + "description": "Create an asset with an explicit organization identifier and bounded inventory fields. An explicit empty organizationId preserves the canonical unassigned asset behavior. The API assigns its identifier. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "organizationId": { + "type": "string", + "maxLength": 128 + }, + "type": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "manufacturer": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "model": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "serialNumber": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "notes": { + "type": [ + "string", + "null" + ], + "maxLength": 32768 + } + }, + "required": [ + "name", + "organizationId" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_asset", + "description": "Replace the selected asset\u0027s inventory fields and organization. Read current values first; supply all optional fields explicitly, using null only to clear them. The route determines the stored identifier. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "assetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "maxLength": 200, + "minLength": 1, + "pattern": "\\S" + }, + "organizationId": { + "type": "string", + "maxLength": 128 + }, + "type": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "manufacturer": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "model": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "serialNumber": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "notes": { + "type": [ + "string", + "null" + ], + "maxLength": 32768 + } + }, + "required": [ + "name", + "organizationId", + "type", + "manufacturer", + "model", + "serialNumber", + "notes" + ] + } + }, + "required": [ + "assetId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_asset", + "description": "Delete exactly one selected asset through the canonical administrator endpoint. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "assetId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "assetId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "instance_branding", + "description": "Read effective instance branding, persisted values, defaults and each field\u0027s source/editability. Deployment-owned values remain authoritative. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_instance_branding", + "description": "Save all instance branding fields after reading their current values and editability. Explicit null or blank resets an editable field to its configured default. The canonical provider preserves deployment-owned values and validates web/image URLs. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "applicationName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "organizationName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "applicationUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "organizationUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "supportUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "supportEmail": { + "type": [ + "string", + "null" + ], + "maxLength": 320 + }, + "logoUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "compactLogoUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "faviconUrl": { + "type": [ + "string", + "null" + ], + "maxLength": 2048 + }, + "emailFromDisplayName": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "tagline": { + "type": [ + "string", + "null" + ], + "maxLength": 2000 + } + }, + "required": [ + "applicationName", + "organizationName", + "applicationUrl", + "organizationUrl", + "supportUrl", + "supportEmail", + "logoUrl", + "compactLogoUrl", + "faviconUrl", + "emailFromDisplayName", + "tagline" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "tenant_branding", + "description": "Read saved or default email branding for the canonical positive integer branding tenant identifier; organization and SLA identifiers remain separate string selectors. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "brandingTenantId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + } + }, + "required": [ + "brandingTenantId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "upload_branding_logo", + "description": "Upload one image logo of at most 1 MiB through the canonical multipart file endpoint, then read tenant branding to verify the stored logo URL. Use the positive integer branding tenant identifier. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "brandingTenantId": { + "type": "integer", + "minimum": 1, + "maximum": 2147483647 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "fileName": { + "type": "string", + "maxLength": 255, + "minLength": 1, + "pattern": "^(?!\\.{1,2}$)[^/\\\\\\u0000-\\u001F\\u007F-\\u009F]\u002B$", + "examples": [ + "fixture.png" + ] + }, + "contentType": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "^image/[A-Za-z0-9!#$\u0026^_.\u002B-]\u002B$", + "examples": [ + "image/png" + ] + }, + "contentBase64": { + "type": "string", + "maxLength": 1398104, + "minLength": 1, + "pattern": "^(?:[A-Za-z0-9\u002B/]{4})*(?:[A-Za-z0-9\u002B/]{2}==|[A-Za-z0-9\u002B/]{3}=)?$", + "examples": [ + "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO\u002BjJZkAAAAASUVORK5CYII=" + ], + "description": "Base64 file bytes, 1 byte through 1 MiB after decoding. No data-URL prefix or embedded whitespace." + } + }, + "required": [ + "fileName", + "contentType", + "contentBase64" + ] + } + }, + "required": [ + "brandingTenantId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "background_worker_settings", + "description": "Read saved background-worker enablement, actual queue/storage runtime and recurring/Graph synchronization job counts. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "update_background_worker_settings", + "description": "Explicitly enable or disable background processing through the runtime administration service, which reconciles Graph dataset schedules. Inspect pending work before disabling, and verify the resulting settings and job counts. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "enabled": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ] + } + }, + "required": [ + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "my_credentials", + "description": "List the authenticated owner\u0027s integration credential metadata, scopes, expiry and revocation state. Never returns credential secrets or another owner\u0027s records; creating additional account credentials retains its separate interactive consent boundary. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "revoke_my_credential", + "description": "Revoke one of the authenticated owner\u0027s credentials. Existing cached execution tokens are invalidated by current credential checks. A credential owned by another account remains inaccessible. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "credentialId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "credentialId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_my_credential_record", + "description": "Revoke and permanently remove one of the authenticated owner\u0027s credential records through the canonical lifecycle. Read owned metadata first and preserve any required audit evidence before confirmation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "credentialId": { + "type": "string", + "format": "uuid", + "not": { + "const": "00000000-0000-0000-0000-000000000000" + }, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "credentialId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "dashboard", + "description": "Read live administrative incident, request and change dashboard metrics. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "technician_dashboard", + "description": "Read the authenticated technician\u0027s authorized open ticket counts. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "customer_dashboard", + "description": "Read the current linked customer\u0027s ticket summary. An account with no linked customer receives the canonical empty summary. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "online_users", + "description": "Read identities currently connected to the platform\u0027s presence service. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + } + }, + "required": [ + "operation" + ] + } + ] + } + }, + { + "tool": "helpdesk_tickets", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "timeline_count", + "description": "Count timeline entries. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1 + }, + "ticketId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "TicketCountRequest for helpdesk_tickets operation timeline_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "attachments_count", + "description": "Count attachments. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1 + }, + "ticketId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "TicketCountRequest for helpdesk_tickets operation attachments_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "listeners_count", + "description": "Count listeners. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1 + }, + "ticketId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ticketType", + "ticketId" + ], + "description": "TicketCountRequest for helpdesk_tickets operation listeners_count. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "mark_as_seen", + "description": "mark_as_seen operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "ticketId" + ], + "description": "TicketSeenRequest for helpdesk_tickets operation mark_as_seen. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "organization_options", + "description": "Read the enabled organizations available in the caller\u0027s ticket creation and editing interface. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "module": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incident", + "request", + "change" + ], + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "module" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "customer_options", + "description": "Read enabled customer choices for one authorized organization and ticket module. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "module": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incident", + "request", + "change" + ], + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "organizationId", + "module" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "search_assignees", + "description": "Search bounded eligible assignees, including saved external support coverage. Use the returned eligible identity in confirmed assignment actions. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "limit": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 50 + }, + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "module": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incident", + "request", + "change" + ], + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "organizationId", + "module" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "current_assignee", + "description": "Resolve an existing ticket assignment, including a retained user who is no longer eligible for a new assignment. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "organizationId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + }, + "module": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incident", + "request", + "change" + ], + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "ticketId", + "organizationId", + "module" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "filter_options", + "description": "Search authorized organization, requested-for and assignee labels for ticket filters. selectedId and customerOrgId are bounded repeated query values. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "dimension": { + "type": "string", + "maxLength": 262144, + "enum": [ + "customer", + "for", + "assignee" + ], + "minLength": 1, + "pattern": "\\S" + }, + "q": { + "type": [ + "string", + "null" + ], + "maxLength": 200 + }, + "take": { + "type": [ + "integer", + "null" + ], + "minimum": 1, + "maximum": 50 + }, + "customerOrgId": { + "type": [ + "array", + "null" + ], + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1, + "maxLength": 200, + "pattern": "\\S" + } + }, + "selectedId": { + "type": [ + "array", + "null" + ], + "maxItems": 20, + "items": { + "type": "string", + "minLength": 1, + "maxLength": 200, + "pattern": "\\S" + } + }, + "module": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incident", + "request", + "change" + ], + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "dimension", + "module" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "set_customer", + "description": "Set a requester only on a ticket without one, using an enabled customer in the same organization. Read the ticket afterward to verify the saved requester. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ticketType": { + "type": "string", + "maxLength": 262144, + "enum": [ + "incidents", + "requests", + "changes" + ], + "minLength": 1, + "pattern": "\\S" + }, + "ticketId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "body": { + "type": "object", + "additionalProperties": false, + "properties": { + "customerId": { + "type": "string", + "maxLength": 128, + "minLength": 1, + "pattern": "\\S" + } + }, + "required": [ + "customerId" + ] + } + }, + "required": [ + "ticketType", + "ticketId", + "body" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "incident_activity", + "description": "Read the persisted incident activity audit, independently of the rendered timeline. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "incidentId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "incidentId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "request_worklogs", + "description": "Read authorized request worklog records and their stored effort. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "requestId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "self_service_tasks", + "description": "Read task progress through the same owned-request and released-form audience rules as the self-service interface. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "requestId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "requestId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + }, + { + "tool": "helpdesk_users", + "inputSchema": { + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "description": "Use exactly the outer envelope { operation, request, confirm }. Put every operation-specific field inside request; never place those fields at the tool root.", + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "list", + "description": "list operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": {}, + "required": [], + "description": "ListRequest for helpdesk_users operation list. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "get", + "description": "get operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "userId": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "userId" + ], + "description": "UserRequest for helpdesk_users operation get. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "by_email", + "description": "by_email operation. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Unused for this read operation." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "email": { + "type": "string", + "minLength": 1 + } + }, + "required": [ + "email" + ], + "description": "UserEmailRequest for helpdesk_users operation by_email. All operation-specific fields belong inside this request object, never at the tool root." + } + }, + "required": [ + "operation", + "request" + ] + } + ] + } + } + ] +} \ No newline at end of file diff --git a/docs/contracts/mcp-operation-catalog.json b/docs/contracts/mcp-operation-catalog.json index dd6f7e1b..106ce39f 100644 --- a/docs/contracts/mcp-operation-catalog.json +++ b/docs/contracts/mcp-operation-catalog.json @@ -1,8 +1,8 @@ { - "schemaHash": "fc3603d87ad56fc994cd77385474874a5bc5c9df79a7dc825f5785460463a6f7", - "catalogRevision": "2026-10-20.beta9-contracts-v24", - "catalogHash": "44d767508d35628a4a9c562e842834ad97053435133890646b417edd5b189f74", - "operationCount": 389, + "schemaHash": "b66e9eca38b35b255b4f98e92db50a2f08eda7675ca72a88c2aec5e64c51e16c", + "catalogRevision": "2026-10-25.beta11-contracts-v25", + "catalogHash": "8a73e9abd9a2804afe8bb12de063617e94cd25dae7ce16acf15d31082e234972", + "operationCount": 390, "operations": [ { "tool": "helpdesk_auth", @@ -21841,6 +21841,68 @@ "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." } }, + { + "tool": "helpdesk_email_settings", + "operation": "delete_rule", + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "previewSupported": true, + "description": "Delete one explicitly selected inbound rule while preserving its message processing audit history. Already started message work is not cancelled or replayed.", + "sensitiveResultFields": [], + "transports": [ + "stdio", + "http" + ], + "transportSupport": { + "stdio": "Available with explicitly configured API identity; authority and prerequisites apply", + "http": "requires_explicit_administrator_identity: ordinary bounded integration credential is denied" + }, + "credentialModes": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "ownerAdministrationCredential": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account\u0027s current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + }, + "identifiers": [ + { + "field": "ruleId", + "type": "string", + "source": "Existing authorized record; synthetic arbitrary identifiers do not establish a positive operation" + } + ], + "prerequisites": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Use the typed request.body and confirmed operation, then independently read the changed record and its durable effect. Preview performs no upstream request. Any prerequisite external integration must already be configured through a supported secure pairing flow." + ], + "requestSchema": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, { "tool": "helpdesk_email_settings", "operation": "reorder_rules", @@ -40760,6 +40822,34 @@ "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." } }, + { + "tool": "helpdesk_email_settings", + "operation": "delete_rule", + "examples": { + "schemaValidConfirmed": { + "operation": "delete_rule", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "schemaValidPreview": { + "operation": "delete_rule", + "request": { + "ruleId": "Example" + }, + "confirm": false + }, + "schemaInvalid": { + "operation": "not_a_supported_operation", + "request": { + "ruleId": "Example" + }, + "confirm": true + }, + "scope": "Synthetic schema construction only. Record existence, authority, effects and live prerequisites require independent fixtures and readback." + } + }, { "tool": "helpdesk_email_settings", "operation": "reorder_rules", @@ -57556,6 +57646,40 @@ "request" ] }, + { + "type": "object", + "additionalProperties": false, + "properties": { + "operation": { + "const": "delete_rule", + "description": "Delete one explicitly selected inbound rule while preserving its message processing audit history. Already started message work is not cancelled or replayed. Select this operation in the outer operation field." + }, + "confirm": { + "type": "boolean", + "default": false, + "description": "Required as true to perform this mutation. Calling with false performs no upstream change." + }, + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "ruleId": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + }, + "required": [ + "ruleId" + ], + "description": "All operation-specific fields belong inside this request object. Put API mutation fields inside request.body; route and query selectors stay alongside body." + } + }, + "required": [ + "operation", + "request" + ] + }, { "type": "object", "additionalProperties": false, diff --git a/docs/contracts/mcp-operation-contracts.md b/docs/contracts/mcp-operation-contracts.md index 70c594a5..3caf2939 100644 --- a/docs/contracts/mcp-operation-contracts.md +++ b/docs/contracts/mcp-operation-contracts.md @@ -7,10 +7,15 @@ credential requirements, authority, identifiers and prerequisites. The API resolves live access; discovery does not grant permission. These MCP contracts apply to stdio and HTTP transports against the same product version; the [CLI guide](../integrations/cli-stdio.md) describes command-line syntax. -The [inventory delta](mcp-operation-inventory-delta.json) compares the complete -[beta.7 source catalog](mcp-operation-catalog-beta7.json) with beta.8. It retains -all 155 historical operations, records every new named operator adapter and -identifies semantic changes separately from runtime acceptance evidence. +The current catalog revision `2026-10-25.beta11-contracts-v25` contains 390 +operations on 37 tools. The [inventory delta](mcp-operation-inventory-delta.json) +compares the complete [beta.10 source catalog](mcp-operation-catalog-beta10.json) +with beta.11: all 389 prior operation contracts remain unchanged, and +`helpdesk_email_settings.delete_rule` adds confirmed administrator deletion +while preserving delivery and rule audit history. The +[retained beta.8 mapping](mcp-operation-inventory-delta-beta8.json) records the +earlier operator expansion. These source mappings remain distinct from fresh +runtime acceptance evidence. ## Requests, previews and effects @@ -383,8 +388,8 @@ additive read of the current API execution principal at `/api/v1/auth/me` in eve mode. In external HTTP mode it reports the separately configured downstream principal, not the ingress OAuth caller. Existing `helpdesk_auth.status` keeps its original mode-specific behavior and remains the only operation authorized -for a temporary setup verifier. The complete beta.7 catalog is retained as an -immutable baseline. Use the current generated catalog for beta.8 counts and +for a temporary setup verifier. Historical catalogs, including the complete +beta.10 catalog, are retained as immutable baselines. Use the current generated catalog for beta.11 counts and schemas. Follow the [owner-administration approval procedure](../mcp-http/configuration.md#approve-an-agent-to-administer-the-instance) for caller-bound full HTTP authority; the [external provisioning procedure](../mcp-http/configuration.md#provision-an-explicit-external-authority) remains available for independently configured external principals. Both require diff --git a/docs/contracts/mcp-operation-inventory-delta-beta8.json b/docs/contracts/mcp-operation-inventory-delta-beta8.json new file mode 100644 index 00000000..beb4658e --- /dev/null +++ b/docs/contracts/mcp-operation-inventory-delta-beta8.json @@ -0,0 +1,16163 @@ +{ + "baseline": { + "sourceCommit": "a2c3b613471e5274174388070c4f844702794e28", + "file": "mcp-operation-catalog-beta7.json", + "catalogRevision": "2026-10-18.mcp-campaign-repairs-v22", + "catalogHash": "3290c0447eb033b327d9b15ea949c608bf0ae0a35c45556fda90b98abf3270bf", + "schemaHash": "cb1a42c9d8990caece7c2cff0c1e1d8e89f54d5d7bf639e7f057e7021f6406af", + "operationCount": 155, + "toolCount": 28, + "fileSha256": "66061736f4be91f0fecc50f81aaab23945a1dbf55ef230d7c17c69420a9ca7a9" + }, + "current": { + "file": "mcp-operation-catalog.json", + "catalogRevision": "2026-10-19.mcp-owner-operations-v23", + "catalogHash": "f8aa2de86bf2cf46d123ba06a8bde1235ca0156758c4d1aead4febe8179ff243", + "schemaHash": "dd1d6d04490d740851d4d7e20bae92ca15ba259dec95994c8b0cda4d328d3c14", + "operationCount": 389, + "toolCount": 37, + "fileSha256": "fcccc510321370534fd882696ebc3b5c086af396adacea7d014a9359ca64f34b" + }, + "previousMapping": "mcp-operation-inventory-delta-beta7.json", + "addedTools": [ + "helpdesk_attachments", + "helpdesk_automation", + "helpdesk_connections", + "helpdesk_datasets", + "helpdesk_email_settings", + "helpdesk_mail", + "helpdesk_sla", + "helpdesk_support", + "helpdesk_tenant_admin" + ], + "addedOperations": [ + "helpdesk_ai_assistant.chat", + "helpdesk_ai_assistant.chat_abandon", + "helpdesk_ai_assistant.chat_capabilities", + "helpdesk_ai_assistant.chat_history", + "helpdesk_ai_assistant.chat_new", + "helpdesk_ai_assistant.chat_open", + "helpdesk_ai_assistant.chat_reconcile", + "helpdesk_ai_assistant.chat_respond", + "helpdesk_ai_assistant.chat_send", + "helpdesk_ai_assistant.chat_stop_waiting", + "helpdesk_ai_assistant.create_webhook", + "helpdesk_ai_assistant.dispatch_investigation", + "helpdesk_ai_assistant.eligible_configurations", + "helpdesk_ai_assistant.investigation_worklog", + "helpdesk_ai_assistant.set_webhook_state", + "helpdesk_ai_assistant.update_webhook", + "helpdesk_ai_assistant.webhook_configurations", + "helpdesk_attachments.download", + "helpdesk_attachments.list", + "helpdesk_attachments.upload", + "helpdesk_auth.revoke_self", + "helpdesk_automation.approve_task", + "helpdesk_automation.approver_candidates", + "helpdesk_automation.binding_by_task", + "helpdesk_automation.binding_drift_preview", + "helpdesk_automation.binding_issues", + "helpdesk_automation.bindings", + "helpdesk_automation.callback_rejections", + "helpdesk_automation.create_binding", + "helpdesk_automation.create_form", + "helpdesk_automation.create_request_definition", + "helpdesk_automation.create_rule", + "helpdesk_automation.critical_failures", + "helpdesk_automation.delete_binding", + "helpdesk_automation.delete_rule", + "helpdesk_automation.escalated_tasks", + "helpdesk_automation.get_binding", + "helpdesk_automation.get_rule", + "helpdesk_automation.import_binding_inputs", + "helpdesk_automation.mark_binding_import_pending", + "helpdesk_automation.my_task_approval", + "helpdesk_automation.overdue_tasks", + "helpdesk_automation.pending_retries", + "helpdesk_automation.refresh_binding_drift", + "helpdesk_automation.reject_task", + "helpdesk_automation.rules", + "helpdesk_automation.sync_binding_inputs", + "helpdesk_automation.update_binding", + "helpdesk_automation.update_form", + "helpdesk_automation.update_rule", + "helpdesk_automation.workflow_metrics", + "helpdesk_automation.workflow_timeline", + "helpdesk_changes.my_approval", + "helpdesk_changes.review_approval", + "helpdesk_connections.confirm_netclaw_session_owner", + "helpdesk_connections.delete_mapping", + "helpdesk_connections.delete_pair", + "helpdesk_connections.directory", + "helpdesk_connections.generate_pairing_code", + "helpdesk_connections.incident_sources", + "helpdesk_connections.list", + "helpdesk_connections.netclaw_settings", + "helpdesk_connections.netclaw_unbound_sessions", + "helpdesk_connections.pair", + "helpdesk_connections.pair_netclaw", + "helpdesk_connections.register_incident_source", + "helpdesk_connections.save_mapping", + "helpdesk_connections.set_incident_source_credential", + "helpdesk_connections.set_incident_source_state", + "helpdesk_connections.test_mapping", + "helpdesk_connections.test_netclaw", + "helpdesk_connections.test_netclaw_draft", + "helpdesk_connections.update_netclaw_settings", + "helpdesk_datasets.create", + "helpdesk_datasets.create_credential", + "helpdesk_datasets.credentials", + "helpdesk_datasets.delete", + "helpdesk_datasets.get", + "helpdesk_datasets.graph_settings", + "helpdesk_datasets.list", + "helpdesk_datasets.options", + "helpdesk_datasets.revoke_credential", + "helpdesk_datasets.rows", + "helpdesk_datasets.save_graph_settings", + "helpdesk_datasets.sync_graph", + "helpdesk_datasets.update", + "helpdesk_datasets.upsert_rows", + "helpdesk_email_settings.archive", + "helpdesk_email_settings.create", + "helpdesk_email_settings.create_layout", + "helpdesk_email_settings.create_rule", + "helpdesk_email_settings.create_template", + "helpdesk_email_settings.delete_layout", + "helpdesk_email_settings.delete_template", + "helpdesk_email_settings.diagnostics", + "helpdesk_email_settings.disable", + "helpdesk_email_settings.disable_rule", + "helpdesk_email_settings.effective", + "helpdesk_email_settings.enable", + "helpdesk_email_settings.enable_rule", + "helpdesk_email_settings.get", + "helpdesk_email_settings.get_rule", + "helpdesk_email_settings.historical_import", + "helpdesk_email_settings.historical_preview", + "helpdesk_email_settings.layout_choices", + "helpdesk_email_settings.layouts", + "helpdesk_email_settings.list", + "helpdesk_email_settings.outgoing", + "helpdesk_email_settings.preview_template", + "helpdesk_email_settings.reorder_rules", + "helpdesk_email_settings.retry_receipt", + "helpdesk_email_settings.rule_audit", + "helpdesk_email_settings.rules", + "helpdesk_email_settings.save_outgoing", + "helpdesk_email_settings.send_test", + "helpdesk_email_settings.set_worker", + "helpdesk_email_settings.sync", + "helpdesk_email_settings.templates", + "helpdesk_email_settings.test_draft_mailbox", + "helpdesk_email_settings.test_mailbox", + "helpdesk_email_settings.test_outgoing", + "helpdesk_email_settings.update", + "helpdesk_email_settings.update_layout", + "helpdesk_email_settings.update_rule", + "helpdesk_email_settings.update_template", + "helpdesk_email_settings.upload_template_image", + "helpdesk_email_settings.worker_status", + "helpdesk_incidents.bulk_delete", + "helpdesk_incidents.bulk_marketing_spam", + "helpdesk_incidents.create_relation", + "helpdesk_incidents.delete_relation", + "helpdesk_incidents.relations", + "helpdesk_mail.changed_route_preview", + "helpdesk_mail.failed", + "helpdesk_mail.outgoing_retry_preview", + "helpdesk_mail.pending", + "helpdesk_mail.pending_actions", + "helpdesk_mail.pending_count", + "helpdesk_mail.pending_organizations", + "helpdesk_mail.retry", + "helpdesk_mail.retry_confirmed_undelivered", + "helpdesk_mail.retry_current_outgoing", + "helpdesk_mail.retry_current_route", + "helpdesk_mail.send", + "helpdesk_mail.test_provider", + "helpdesk_mail.uncertain_retry_preview", + "helpdesk_notifications.error_summary", + "helpdesk_notifications.timeline", + "helpdesk_notifications.unread", + "helpdesk_sla.breached", + "helpdesk_sla.calendars", + "helpdesk_sla.completed", + "helpdesk_sla.compliance", + "helpdesk_sla.create_calendar", + "helpdesk_sla.create_policy", + "helpdesk_sla.create_report_subscription", + "helpdesk_sla.delete_calendar", + "helpdesk_sla.delete_policy", + "helpdesk_sla.delete_report_subscription", + "helpdesk_sla.near_breach", + "helpdesk_sla.pause_ticket", + "helpdesk_sla.policies", + "helpdesk_sla.report_subscriptions", + "helpdesk_sla.resume_ticket", + "helpdesk_sla.save_tenant_settings", + "helpdesk_sla.tenant_settings", + "helpdesk_sla.update_calendar", + "helpdesk_sla.update_policy", + "helpdesk_sla.update_report_subscription", + "helpdesk_support.add_member", + "helpdesk_support.bootstrap_defaults", + "helpdesk_support.coverage", + "helpdesk_support.create_coverage", + "helpdesk_support.create_group", + "helpdesk_support.create_subscription", + "helpdesk_support.delete_coverage", + "helpdesk_support.delete_group", + "helpdesk_support.delete_subscription", + "helpdesk_support.get_group", + "helpdesk_support.groups", + "helpdesk_support.members", + "helpdesk_support.my_preferences", + "helpdesk_support.recipient_preview", + "helpdesk_support.remove_member", + "helpdesk_support.set_my_preference", + "helpdesk_support.set_user_preference", + "helpdesk_support.subscriptions", + "helpdesk_support.update_coverage", + "helpdesk_support.update_group", + "helpdesk_support.update_member", + "helpdesk_support.update_subscription", + "helpdesk_support.user_preferences", + "helpdesk_tenant_admin.assets", + "helpdesk_tenant_admin.assignments", + "helpdesk_tenant_admin.background_worker_settings", + "helpdesk_tenant_admin.create_asset", + "helpdesk_tenant_admin.create_local_account", + "helpdesk_tenant_admin.customer_dashboard", + "helpdesk_tenant_admin.dashboard", + "helpdesk_tenant_admin.delegable_roles", + "helpdesk_tenant_admin.delete_asset", + "helpdesk_tenant_admin.delete_my_credential_record", + "helpdesk_tenant_admin.disable_local_account", + "helpdesk_tenant_admin.enable_local_account", + "helpdesk_tenant_admin.get_asset", + "helpdesk_tenant_admin.instance_branding", + "helpdesk_tenant_admin.local_account_assignments", + "helpdesk_tenant_admin.local_account_status", + "helpdesk_tenant_admin.members", + "helpdesk_tenant_admin.my_credentials", + "helpdesk_tenant_admin.online_users", + "helpdesk_tenant_admin.organizations", + "helpdesk_tenant_admin.replace_assignments", + "helpdesk_tenant_admin.replace_local_account_assignments", + "helpdesk_tenant_admin.reset_customer_login", + "helpdesk_tenant_admin.reset_local_account", + "helpdesk_tenant_admin.revoke_my_credential", + "helpdesk_tenant_admin.settings", + "helpdesk_tenant_admin.technician_dashboard", + "helpdesk_tenant_admin.tenant_branding", + "helpdesk_tenant_admin.update_asset", + "helpdesk_tenant_admin.update_background_worker_settings", + "helpdesk_tenant_admin.update_instance_branding", + "helpdesk_tenant_admin.update_settings", + "helpdesk_tenant_admin.upload_branding_logo", + "helpdesk_tickets.current_assignee", + "helpdesk_tickets.customer_options", + "helpdesk_tickets.filter_options", + "helpdesk_tickets.incident_activity", + "helpdesk_tickets.organization_options", + "helpdesk_tickets.request_worklogs", + "helpdesk_tickets.search_assignees", + "helpdesk_tickets.self_service_tasks", + "helpdesk_tickets.set_customer" + ], + "removedOperations": [], + "retainedOperationCount": 155, + "changedRetainedOperationCount": 155, + "intentionalChanges": [ + "Add explicitly consented owner-administration HTTP MCP grants with current owner administrator, credential, organization and revocation checks; ordinary scoped credentials retain their ceiling.", + "Retain exact external AI authority and add an explicitly revalidated owner MCP alternative for logs.search and bound ai_assistant.report; invocation/event/ticket/correlation checks remain authoritative.", + "Add typed fixed-route operator adapters for automation forms, rules, bindings, provider targets, mail/settings/templates, support, SLA, datasets, attachments, connections and instance/tenant administration.", + "Expose local-account and linked-local-customer activation separately from the retained external identity-provider customer invitation operations.", + "Preserve the authenticated owner's credential metadata, revoke and record deletion capability while retaining interactive consent for issuance; ordinary and owner agents can revoke their current source credential.", + "Add actor-bound request-task and change approval decisions with shared signed/authenticated transactional serialization, durable effects and recoverable postcommit workflow continuation.", + "Add AI webhook configuration, bound investigation dispatch/worklogs and native chat interaction/recovery; first-use GET chat_open is declared mutating and requires confirmation.", + "Bind AI dispatch idempotency to its organization, ticket, configuration, actor and instruction before outbound effects; incompatible key reuse returns conflict.", + "Add typed Netclaw pair-and-save, unsaved-settings testing and exact reviewed legacy-session owner assignment with revision checks.", + "Add authenticated dataset row writes sharing the canonical ingestion/Graph database fence; case-insensitive keys, explicit complete replacement and concurrency conflicts are disclosed.", + "Require explicit sensitive configuration writes; redact submitted and stored secrets throughout envelopes and previews; allow only operation-specific newly minted one-time fields on successful sensitive results; HTTP MCP responses are no-store.", + "Add incident relationship list/create/delete and confirmed silent bulk deletion/marketing-spam operations; ticket requester/assignee choices, dashboard and notification timeline APIs are callable.", + "Make JSON schemas executable for nullable replacement fields, defined enum values, exact integral JSON lexemes, bounded collections/content, dates/durations, image multipart transport, query choices and per-item limits." + ], + "campaignEvidence": { + "scope": "This file maps source contracts only. It carries no production pass result and does not relabel historical beta.7 blocked/failed rows.", + "requirement": "Every current operation needs its own fresh positive business evidence; required negative authority, isolation, confirmation, recovery and domain cases remain additional campaign gates.", + "historicalSource": "Original beta.7 catalog and inventory mapping are retained byte-for-byte; supplied prior campaign evidence remains separate.", + "schemaDigestEncoding": "Per-operation request schema SHA-256 uses UTF-8 JSON with sorted object keys and compact separators; catalog/schema hashes are the exported runtime values." + }, + "operations": [ + { + "operationKey": "helpdesk_admin_mutations.create_category", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.create_category", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/categories", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_category operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/categories", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_category operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "08886105b8fb58ef7d6188d16de1a26ac906545e9f752c8155fee5d2ea3a903b", + "currentRequestSchemaSha256": "08886105b8fb58ef7d6188d16de1a26ac906545e9f752c8155fee5d2ea3a903b", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.create_customer", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.create_customer", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_customer operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_customer operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8a2cc60d0a94d142f3b115b99da497e76aecb82e82693633834875afd6d89df0", + "currentRequestSchemaSha256": "8a2cc60d0a94d142f3b115b99da497e76aecb82e82693633834875afd6d89df0", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.create_organization", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.create_organization", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/organizations", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_organization operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/organizations", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_organization operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "f1680e29ab0ce0e9d4eb7efb981f378861914d3f2d662736546c6374cee9ff40", + "currentRequestSchemaSha256": "f1680e29ab0ce0e9d4eb7efb981f378861914d3f2d662736546c6374cee9ff40", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.create_request_form", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.create_request_form", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-forms", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_request_form operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-forms", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_request_form operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "31ce93f6a1d690552ef49d1b2ba1cf5c211e8fa509589fd46277b62c1f67cbc7", + "currentRequestSchemaSha256": "31ce93f6a1d690552ef49d1b2ba1cf5c211e8fa509589fd46277b62c1f67cbc7", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.create_role", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.create_role", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/role-definitions", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_role operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/role-definitions", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_role operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "7da310104da15f1030a060859bd8da158612d6314ce862aea28596f7c00fde7b", + "currentRequestSchemaSha256": "7da310104da15f1030a060859bd8da158612d6314ce862aea28596f7c00fde7b", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin or scoped role-management authority for ownerOrganizationId; only delegable permission intersection", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.create_self_service_request", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.create_self_service_request", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/self-service/requests", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_self_service_request operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/self-service/requests", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_self_service_request operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c2500ce8c29a2a75733a50f4a82706130c1eb37aebe20fa4bd87945b663a890f", + "currentRequestSchemaSha256": "c2500ce8c29a2a75733a50f4a82706130c1eb37aebe20fa4bd87945b663a890f", + "newRequestProperties": [], + "effect": "write", + "authority": "SelfService.User or HelpdeskAdmin, audience-eligible request form and valid payload. Requested-for customer is resolved from the caller's linked customer or an explicit authorized requestedForPersonId/requestedForPersonSource selection in visible organizations.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.create_service", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.create_service", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/services", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_service operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/services", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_service operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "6c54f2121e74d613d3e0769590d6493356f3a4b20f3cad863166cd7eb9893d02", + "currentRequestSchemaSha256": "6c54f2121e74d613d3e0769590d6493356f3a4b20f3cad863166cd7eb9893d02", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.create_service_request_form", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.create_service_request_form", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/services/{serviceId}/forms/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_service_request_form operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/services/{serviceId}/forms/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_service_request_form operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "cf7b399f1236279ca696f5b4706b566d809f0f1c64ad6be2a63fd0e9ad0f974c", + "currentRequestSchemaSha256": "cf7b399f1236279ca696f5b4706b566d809f0f1c64ad6be2a63fd0e9ad0f974c", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.create_user", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.create_user", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/users", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_user operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/users", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create_user operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "fc5d762c6344c5a4b8f0c69732a09d429c865e9d66b05b587798f2aa0a5289f4", + "currentRequestSchemaSha256": "fc5d762c6344c5a4b8f0c69732a09d429c865e9d66b05b587798f2aa0a5289f4", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.customer_disable_login", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.customer_disable_login", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/disable-login", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "customer_disable_login operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/disable-login", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "customer_disable_login manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "description": { + "old": "customer_disable_login operation.", + "new": "customer_disable_login manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "prerequisites": { + "old": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Disposable existing customer and HelpdeskAdmin; configured supported authentication mode/provider. Invitations require isolated delivery capture for acceptance; Local/ambiguous identity and unavailable-provider results are distinct." + ], + "new": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." + ] + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a3e2f61b3a9e5396c7b3065834e0b032e2876925f0e1f788b650484d95a3a743", + "currentRequestSchemaSha256": "a3e2f61b3a9e5396c7b3065834e0b032e2876925f0e1f788b650484d95a3a743", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.customer_invite", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.customer_invite", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/invite", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "customer_invite operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/invite", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "customer_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "description": { + "old": "customer_invite operation.", + "new": "customer_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "prerequisites": { + "old": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Disposable existing customer and HelpdeskAdmin; configured supported authentication mode/provider. Invitations require isolated delivery capture for acceptance; Local/ambiguous identity and unavailable-provider results are distinct." + ], + "new": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." + ] + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "2490d28e150c64123c476734d2566715f3f78ea921a51e391a06c7b1bdbd928a", + "currentRequestSchemaSha256": "2490d28e150c64123c476734d2566715f3f78ea921a51e391a06c7b1bdbd928a", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.customer_resend_invite", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.customer_resend_invite", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/resend-invite", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "customer_resend_invite operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/resend-invite", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "customer_resend_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "description": { + "old": "customer_resend_invite operation.", + "new": "customer_resend_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "prerequisites": { + "old": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Disposable existing customer and HelpdeskAdmin; configured supported authentication mode/provider. Invitations require isolated delivery capture for acceptance; Local/ambiguous identity and unavailable-provider results are distinct." + ], + "new": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." + ] + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "6c2999659a07f022ecf045efff8801e3560a87fbd8549280946977fa0d6f5177", + "currentRequestSchemaSha256": "6c2999659a07f022ecf045efff8801e3560a87fbd8549280946977fa0d6f5177", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.customer_sync_authentik", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.customer_sync_authentik", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/sync-authentik", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "customer_sync_authentik operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/sync-authentik", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "customer_sync_authentik manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "description": { + "old": "customer_sync_authentik operation.", + "new": "customer_sync_authentik manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "prerequisites": { + "old": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Disposable existing customer and HelpdeskAdmin; configured supported authentication mode/provider. Invitations require isolated delivery capture for acceptance; Local/ambiguous identity and unavailable-provider results are distinct." + ], + "new": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." + ] + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "55bdcb33b4c4f958b0e8a295afbbfaf106160f3efc4d23791a52a1c4295ff604", + "currentRequestSchemaSha256": "55bdcb33b4c4f958b0e8a295afbbfaf106160f3efc4d23791a52a1c4295ff604", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.delete_category", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.delete_category", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/categories/{categoryId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_category operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/categories/{categoryId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_category operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9c26f259c6e85ed190dd2ccb855b819601e7bd6fd6415e8f918bbdaabf2b7eef", + "currentRequestSchemaSha256": "9c26f259c6e85ed190dd2ccb855b819601e7bd6fd6415e8f918bbdaabf2b7eef", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.delete_customer", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.delete_customer", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/customers/{customerId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_customer operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/customers/{customerId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_customer operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9437bc3f9a84285b4cc7c650904d32aa1a6cab5a138efd970e90c5f230f57040", + "currentRequestSchemaSha256": "9437bc3f9a84285b4cc7c650904d32aa1a6cab5a138efd970e90c5f230f57040", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.delete_organization", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.delete_organization", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/organizations/{organizationId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_organization operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/organizations/{organizationId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_organization operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e6c7c3aecc11ce55e82ad41cf21533113a5d0f06bb3219aa777313b363518a10", + "currentRequestSchemaSha256": "e6c7c3aecc11ce55e82ad41cf21533113a5d0f06bb3219aa777313b363518a10", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.delete_request_form", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.delete_request_form", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_request_form operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_request_form operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d3564e06f833aa91e92f9cf054befd4375ebd6274cf5cdbbaedd48600804718f", + "currentRequestSchemaSha256": "d3564e06f833aa91e92f9cf054befd4375ebd6274cf5cdbbaedd48600804718f", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.delete_role", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.delete_role", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/role-definitions/{roleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_role operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/role-definitions/{roleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_role operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "3ea6559a074b9ff3338751c81e11c59328fdf7bb7ff60c502271ffe06a56835a", + "currentRequestSchemaSha256": "3ea6559a074b9ff3338751c81e11c59328fdf7bb7ff60c502271ffe06a56835a", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin or scoped role-management authority for ownerOrganizationId; only delegable permission intersection", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.delete_service", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.delete_service", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/services/{serviceId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_service operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/services/{serviceId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_service operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "b5221c53e28c71730a8805eacc82551712901531e6e790a2d5ce8aab021c3903", + "currentRequestSchemaSha256": "b5221c53e28c71730a8805eacc82551712901531e6e790a2d5ce8aab021c3903", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.delete_user", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.delete_user", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/users/{userId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_user operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/users/{userId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete_user operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9751842a27a95a486e7b6a2ec02534170db8d2199a308cb6c0845676d122d81e", + "currentRequestSchemaSha256": "9751842a27a95a486e7b6a2ec02534170db8d2199a308cb6c0845676d122d81e", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.provision_user", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.provision_user", + "baselineContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/users/provision", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "provision_user operation." + }, + "currentContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/users/provision", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "provision_user operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "write", + "authority": "Authenticated caller with verified email plus issuer/subject or provider-user-ID claims, an established customer login link, and enabled customer/organization; explicitly authorized external administrator may provision without a customer link. Request fields cannot choose another identity.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.update_category", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.update_category", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/categories/{categoryId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_category operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/categories/{categoryId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_category operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "79a2803198699074f576da1647fc12314d9ce291b858a2717b916668bf9b06b0", + "currentRequestSchemaSha256": "79a2803198699074f576da1647fc12314d9ce291b858a2717b916668bf9b06b0", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.update_customer", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.update_customer", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/customers/{customerId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_customer operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/customers/{customerId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_customer operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "aeb0f5cd2d2c3d4ac2535aca06d535c22e216e7c24cb5a55dac57ba9581a8e88", + "currentRequestSchemaSha256": "aeb0f5cd2d2c3d4ac2535aca06d535c22e216e7c24cb5a55dac57ba9581a8e88", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.update_organization", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.update_organization", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/organizations/{organizationId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_organization operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/organizations/{organizationId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_organization operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1d57dd3c377bf2d73c16d42cd97ba31275c6dd8872fdf06e04ecd7025ed90380", + "currentRequestSchemaSha256": "1d57dd3c377bf2d73c16d42cd97ba31275c6dd8872fdf06e04ecd7025ed90380", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.update_organization_branding", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.update_organization_branding", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenants/{tenantId}/branding", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_organization_branding operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenants/{tenantId}/branding", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_organization_branding operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "3ebb4f3e69070edee5db1e185d0e18964930ab1f95e1be4249d8db8fd6e17379", + "currentRequestSchemaSha256": "3ebb4f3e69070edee5db1e185d0e18964930ab1f95e1be4249d8db8fd6e17379", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.update_request_form", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.update_request_form", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_request_form operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_request_form operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/properties/allowedOrganizationIds/type" + ], + "baselineRequestSchemaSha256": "33743ec592053a986515b3da4ee2187da9facbe9075568d9840120d26de6b9f5", + "currentRequestSchemaSha256": "4e5dbdd286145f1e1b15b9c144210c17d0fd3baf3a5a10d9b3cd6a320a3248cc", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.update_role", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.update_role", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/role-definitions/{roleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_role operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/role-definitions/{roleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_role operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8af5055ac40b8186cb77374f845479aaf58b3201a1cfda9dbbad3134ad186c14", + "currentRequestSchemaSha256": "8af5055ac40b8186cb77374f845479aaf58b3201a1cfda9dbbad3134ad186c14", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin or scoped role-management authority for ownerOrganizationId; only delegable permission intersection", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.update_service", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.update_service", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/services/{serviceId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_service operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/services/{serviceId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_service operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "dfd9a8020826219023c100639e7eee2d36b318a6c7021326a19bad2866fd4023", + "currentRequestSchemaSha256": "dfd9a8020826219023c100639e7eee2d36b318a6c7021326a19bad2866fd4023", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_admin_mutations.update_user", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_admin_mutations.update_user", + "baselineContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/users/{userId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_user operation." + }, + "currentContract": { + "requestContract": "AdministrativeMutationRequest", + "method": "PUT", + "pathTemplate": "/api/v1/users/{userId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update_user operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "84d62911f3747bdcdfc771b938b6a3b97551bd0029fb09867ee40f29c8f33d65", + "currentRequestSchemaSha256": "84d62911f3747bdcdfc771b938b6a3b97551bd0029fb09867ee40f29c8f33d65", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.chat", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read at most 200 durable events after cursor from an explicit existing conversation without creating one. Use its returned lastSequence and event sequence values to read remaining pages." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "4908dec419a5b92a250faf12d754f092405ed702ff0965d62501c78bfc1cf1d8", + "newRequestProperties": [ + "conversationId", + "cursor", + "ticketId", + "ticketType" + ], + "effect": "read", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.chat_abandon", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/abandon", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Abandon unresolved delivery using stable resolutionId and expectedMessageId with explicit acknowledgement that the previous remote turn may still execute. The canonical API audits and serializes this resolution." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "6e57682f8c58e09e81bbd6a7595f69fe4e882bf7bfd018340ae78d84f6c795cf", + "newRequestProperties": [ + "body", + "ticketId", + "ticketType" + ], + "effect": "write", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.chat_capabilities", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat-capabilities", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read native chat availability and its actual disabled reason. SQLite or deployment-disabled native chat is an unavailable capability, not a successful chat campaign." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", + "newRequestProperties": [ + "ticketId", + "ticketType" + ], + "effect": "read", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.chat_history", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/history", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List up to 50 native conversations for this ticket, active first, with skip for older pages. Provider credentials and session paths are excluded." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "37773abfcc1a1210f6f0c77f1e121c0ab18684c646dfecc1fd48b671aa7a0984", + "newRequestProperties": [ + "skip", + "ticketId", + "ticketType" + ], + "effect": "read", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.chat_new", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/new", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Archive the selected idle conversation and open a blank one. Active or unresolved turns must first complete or use the explicit recovery/abandon lifecycle." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "fb7b1d8500fa90bb7e7959fb6dc16dbf10ddeacbe86a7bd35c08dfcb0d731a37", + "newRequestProperties": [ + "body", + "ticketId", + "ticketType" + ], + "effect": "write", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.chat_open", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Open the current native conversation, creating the first one when absent. This canonical GET can persist a conversation, so the MCP operation requires explicit confirmation. Read chat_capabilities first." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", + "newRequestProperties": [ + "ticketId", + "ticketType" + ], + "effect": "write", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.chat_reconcile", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/reconcile", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Request conservative recovery of an unresolved native turn using the saved provider session. This never resends the operator message." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "fb7b1d8500fa90bb7e7959fb6dc16dbf10ddeacbe86a7bd35c08dfcb0d731a37", + "newRequestProperties": [ + "body", + "ticketId", + "ticketType" + ], + "effect": "external_io", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.chat_respond", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/interactions/{callId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Select one exact offered option for the current interaction. Conversation, call ID, option and current awaiting-approval state remain enforced by the canonical API." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "0eeb40eaeb9c1d5606f4709f2ea107ad903c8c96c06866066d5c2ab3ce0bcc41", + "newRequestProperties": [ + "body", + "callId", + "ticketId", + "ticketType" + ], + "effect": "external_io", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.chat_send", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/messages", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Submit one native chat message with a stable clientMessageId. Retry only the exact same text and identity; if delivery is uncertain, inspect chat and use chat_reconcile without resending." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "49ebeb7437c02dbafd22c91f4c198a650486ae7d82fb2991276b631569e24215", + "newRequestProperties": [ + "body", + "ticketId", + "ticketType" + ], + "effect": "external_io", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.chat_stop_waiting", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/stop-waiting", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Stop waiting for the explicitly identified uncertain turn and retire its local transport owner. This records uncertainty and never claims remote cancellation or resends the message." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a93a9272b7ee9d137f0bb147075de6a53dd6613a0b5113a39db64c230cbc3cba", + "newRequestProperties": [ + "body", + "ticketId", + "ticketType" + ], + "effect": "external_io", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.create_webhook", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an organization-bound AI assistance webhook with numeric ticket areas (0 incidents, 1 requests, 2 changes). The API validates the configured endpoint; no investigation is dispatched by saving settings." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "07b2ffc2fa959a37b86f23ddc0567c9484f60672e8dd83e808c0f46c748f0296", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.dispatch_investigation", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/investigations", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Dispatch one AI investigation using a saved eligible configuration and an explicit operator assistance request. Keep the same idempotencyKey for retries of this exact ticket, configuration and request; read investigation_worklog before retrying an uncertain result." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "0ff14dba07d4da022d0cffe13081ca223977dc0a90d4cd8ce350172e9233bc68", + "newRequestProperties": [ + "body", + "ticketId", + "ticketType" + ], + "effect": "external_io", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.eligible_configurations", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/eligible-configurations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List active AI webhook configurations eligible for this incident, request or change and its actual organization." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", + "newRequestProperties": [ + "ticketId", + "ticketType" + ], + "effect": "read", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.investigation_worklog", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/worklog", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read persisted investigation identities, correlation IDs, progress and outcomes for this ticket. This snapshot provides the worklog evidence also shown by the UI stream." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", + "newRequestProperties": [ + "ticketId", + "ticketType" + ], + "effect": "read", + "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.report", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.report", + "baselineContract": { + "requestContract": "AiAssistantWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/ai-assistant/investigations/{invocationId}/worklog", + "effect": "write", + "readOnly": false, + "confirmationRequired": false, + "description": "report operation." + }, + "currentContract": { + "requestContract": "AiAssistantWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/ai-assistant/investigations/{invocationId}/worklog", + "effect": "write", + "readOnly": false, + "confirmationRequired": false, + "description": "report operation." + }, + "changes": { + "authority": { + "old": "Exact AuthentikAiAgent authentication scheme plus authenticated AI invocation reporting authority; matched invocation, ticket, event and correlation binding", + "new": "Exact AuthentikAiAgent scheme or explicit current administrator mcp-owner grant plus authenticated AI invocation reporting authority; matched invocation, ticket, event and correlation binding" + }, + "boundedIntegrationCredential": { + "old": { + "support": "denied_by_policy", + "reason": "The exact AuthentikAiAgent API authentication scheme is required. Ordinary integration credentials and gateway execution tokens cannot satisfy it, regardless of scoped grants. Explicit external Authentik downstream identity is supported; never switch modes as fallback." + }, + "new": { + "support": "denied_by_policy", + "reason": "Ordinary scoped credentials cannot satisfy agent-operation authority. An explicitly approved mcp-owner grant or the exact external AuthentikAiAgent scheme is required; invocation and ticket binding remain authoritative." + } + }, + "credentialModes": { + "old": [ + "explicit external Authentik downstream identity satisfying exact AuthentikAiAgent scheme" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik downstream identity satisfying exact AuthentikAiAgent scheme" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "prerequisites": { + "old": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Real authenticated existing invocation/organization/event/ticket/correlation binding under the exact AI scheme, including token lifetime validation. Report appends AI worklog autonomously; a matching duplicate retains its stored event, while conflicting event-ID reuse and new callbacks after Completed, Failed or Cancelled are rejected." + ], + "new": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Real authenticated existing invocation/organization/event/ticket/correlation binding under an explicitly approved owner grant or exact AI scheme, including token lifetime validation. Report appends AI worklog autonomously; a matching duplicate retains its stored event, while conflicting event-ID reuse and new callbacks after Completed, Failed or Cancelled are rejected." + ] + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d9de2720203d1639e64becad99ff8e922cd8d66ab23b317ff5df2e1ed9dee4b7", + "currentRequestSchemaSha256": "d9de2720203d1639e64becad99ff8e922cd8d66ab23b317ff5df2e1ed9dee4b7", + "newRequestProperties": [], + "effect": "write", + "authority": "Exact AuthentikAiAgent scheme or explicit current administrator mcp-owner grant plus authenticated AI invocation reporting authority; matched invocation, ticket, event and correlation binding", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "Ordinary scoped credentials cannot satisfy agent-operation authority. An explicitly approved mcp-owner grant or the exact external AuthentikAiAgent scheme is required; invocation and ticket binding remain authoritative." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.set_webhook_state", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/{webhookId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable, disable, archive or restore an organization-bound AI webhook configuration with an attributed administrative audit." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "4ce1438baa79a05a362fa015d353c0a632f6b67ae176b5e6c42407912852cbe2", + "newRequestProperties": [ + "body", + "webhookId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.update_webhook", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/{webhookId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the selected AI webhook configuration within its explicit organization. Omit signingSecret or supply an empty value to preserve it; a supplied nonempty secret rotates it without readback." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "23451efcded60b4395d7a0cabb962025c07e7ecbe70ea116afe2861279d73cc5", + "newRequestProperties": [ + "body", + "webhookId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_ai_assistant.webhook_configurations", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List AI webhook configurations for one explicit organization, including enabled/archived state and signing-secret availability; stored secrets remain write-only." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "15b67354f0e2c01b53b248fd8dbe0d81875fae10633208adf50fe1888025eca0", + "newRequestProperties": [ + "organizationId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_attachments.download", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/attachments/{attachmentId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read a bounded attachment as base64 with its media type and filename; maximum file size is 1 MiB." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "0d03de58abb27c5d5ad11f7b09974c39c9fdedcb19b151ed660135b10faa1596", + "newRequestProperties": [ + "attachmentId" + ], + "effect": "read", + "authority": "Parent ticket visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_attachments.list", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tickets/{ticketId}/attachments/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List authorized attachment metadata for an incident, request or change." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c6743d0c7204e68c59160be73539271d484fd9102b2a5254d5048e0c33a511b4", + "newRequestProperties": [ + "ticketId" + ], + "effect": "read", + "authority": "Parent ticket visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_attachments.upload", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/attachments/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Upload one base64 attachment, at most 1 MiB, using the authenticated multipart endpoint. The API enforces the parent ticket's authority." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "2e07f0d1af2d857b51baa4ae64ff38bfc4639ef517eaa21955d1eb86ace53df7", + "newRequestProperties": [ + "body", + "ticketId" + ], + "effect": "write", + "authority": "Parent ticket manager or authorized self-service owner; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_auth.access", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_auth.access", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/auth/me", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the current downstream execution principal's API permissions, organization scope and linked customer; external HTTP ingress identity remains separate." + }, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/auth/me", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the current downstream execution principal's API permissions, organization scope and linked customer; external HTTP ingress identity remains separate." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Authenticated /api/v1/auth/me resolves current execution-principal authority in every credential mode. In external HTTP mode this is the separately configured shared downstream principal, not the ingress caller. Discovery configuration does not imply HelpdeskAdmin or exact AI authority.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_auth.revoke_self", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/integration-credentials/self/revoke", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Revoke the credential used by this request. The next authenticated call will fail until a separately authorized credential is supplied. This cannot issue or broaden another credential." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "write", + "authority": "Current API integration credential or source MCP execution credential; setup verifier excluded; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_auth.status", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_auth.status", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/auth/ai-agent/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authenticated agent status." + }, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/auth/ai-agent/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authenticated agent status." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Caller-bound integration/gateway uses authenticated /api/v1/auth/me; explicit external Authentik uses /api/v1/auth/ai-agent/status requiring exact AuthentikAiAgent scheme. No target or identity-mode fallback. Use access for current downstream API permissions in either mode.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.approve_task", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/approval/approve", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Approve the caller's own assigned pending task before its deadline; resumes the workflow. Repeating the same accepted decision is idempotent." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "1fe4fddfded31c5723aebf6b42233c129d6c617f65607b6b83128d06e3f96341", + "newRequestProperties": [ + "taskId" + ], + "effect": "external_io", + "authority": "Stored designated approver identity plus Request.User, SelfService.User or request management authority in the request organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.approver_candidates", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-task-approvers", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Find designated user/customer approval candidates for a self-service task template." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "347aaac7007365a283479ac1adde24a74a237e936f9ec019654257553d4610c8", + "newRequestProperties": [ + "organizationId", + "pageSize", + "q" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.binding_by_task", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings/by-task", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Resolve the binding for one task template in one form." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "4979b1987ac45545109581fa5ac676b06c18be25bdf53268ddd97b693161f6b5", + "newRequestProperties": [ + "requestFormId", + "taskTemplateId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.binding_drift_preview", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/drift-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Compare the saved form inputs and provider target schema before importing." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", + "newRequestProperties": [ + "bindingId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.binding_issues", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/orchestration/binding-issues", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", + "newRequestProperties": [ + "page", + "pageSize" + ], + "effect": "read", + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.bindings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List automation bindings, optionally for one request form." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "1aea4241843e192bb5930abeae6fcfa43f40892c639b6d4547f3ea064782d7d7", + "newRequestProperties": [ + "requestFormId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.callback_rejections", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/orchestration/callback-rejections", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "1160d40b1278e86e92e2e901a0923f320fd4a5dd6035c9c3499ac4536267cbec", + "newRequestProperties": [ + "lookbackDays", + "page", + "pageSize" + ], + "effect": "read", + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.create_binding", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Bind a form task template to a provider request definition through a saved connection." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "55e1245de181d40388a98dc335aeacc69b98fbf7c24762fa05c2e8f5a8c44999", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.create_form", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-forms/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a self-service request form with a typed fields/tasks schema. Set releaseStatus, audience and each automation task's autoStart deliberately. Task IDs and dependency IDs are UUIDs; the API validates the dependency graph and dataset bindings." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "1e4f5aa05a5417447047c3d09c4d80041fe48f6c3e9fe38d57eb2cc7cc773fdf", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.create_request_definition", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/catalog/request-definitions", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a provider automation target using the selected saved organization mapping. This creates a request definition through the supported provider adapter." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "f92cd7fece53e87b07c0ccd85ba23ace40b4f1f59e24bcf679e034e8e0a76268", + "newRequestProperties": [ + "body", + "connectionId", + "organizationId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.create_rule", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/automation/rules/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an automation rule through the same canonical API as the administration screen. Conditions and actions retain the API's text representation; this operation saves the rule and does not claim a provider execution." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "6ab1987040a166685ac43911c74c2c2fbad0b129ac530a1c92cfea4064e12638", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.critical_failures", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/critical-failures", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "700530b374da8bdbf7d2c408ccf6b3fc4b30854930ff5ee0c825cffe25bc858d", + "newRequestProperties": [ + "page", + "pageSize", + "sinceUtc" + ], + "effect": "read", + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.delete_binding", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one automation binding." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", + "newRequestProperties": [ + "bindingId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.delete_rule", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/automation/rules/{ruleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete exactly one selected automation rule." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", + "newRequestProperties": [ + "ruleId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.escalated_tasks", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/escalated", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", + "newRequestProperties": [ + "page", + "pageSize" + ], + "effect": "read", + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.get_binding", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one saved automation binding." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", + "newRequestProperties": [ + "bindingId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.get_rule", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/automation/rules/{ruleId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one saved automation rule before editing or deleting it." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", + "newRequestProperties": [ + "ruleId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.import_binding_inputs", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/import-inputs", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Import the bound provider input definitions into the form task template." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", + "newRequestProperties": [ + "bindingId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.mark_binding_import_pending", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/mark-import-pending", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Mark a binding for explicit reviewed schema import." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", + "newRequestProperties": [ + "bindingId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.my_task_approval", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-tasks/{taskId}/approval/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the caller's assigned approval. Even an owner grant cannot impersonate another designated approver." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "1fe4fddfded31c5723aebf6b42233c129d6c617f65607b6b83128d06e3f96341", + "newRequestProperties": [ + "taskId" + ], + "effect": "read", + "authority": "Stored designated approver identity plus Request.User, SelfService.User or request management authority in the request organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.overdue_tasks", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/overdue", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", + "newRequestProperties": [ + "page", + "pageSize" + ], + "effect": "read", + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.pending_retries", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/retries-pending", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", + "newRequestProperties": [ + "page", + "pageSize" + ], + "effect": "read", + "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.refresh_binding_drift", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/refresh-drift", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Refresh provider schema drift for saved bindings, optionally limited to a form." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "1aea4241843e192bb5930abeae6fcfa43f40892c639b6d4547f3ea064782d7d7", + "newRequestProperties": [ + "requestFormId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.reject_task", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/approval/reject", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Reject the caller's own assigned pending task with a reason through the canonical cancellation and notification lifecycle." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "2d4ada835af85af7b4b955da370e4c23b1a5ca40aa009a025757d86bbf352ed8", + "newRequestProperties": [ + "body", + "taskId" + ], + "effect": "external_io", + "authority": "Stored designated approver identity plus Request.User, SelfService.User or request management authority in the request organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.rules", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/automation/rules/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List saved automation rules with their trigger, conditions and actions." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.sync_binding_inputs", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/sync-inputs", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Synchronize the form task inputs with its bound automation target." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", + "newRequestProperties": [ + "bindingId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.update_binding", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update or enable/disable an existing automation binding. Omitted properties retain their current values; explicit clear fields remove optional values." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "d7c6b62307d379ad68e39f1c796166beb2e92eec8c89378a1465853c6828ab96", + "newRequestProperties": [ + "bindingId", + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.update_form", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Edit a self-service form through its typed fields/tasks schema; omitted audience and release status remain unchanged. Existing bindings are managed separately through binding operations." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a29b12eab2512bbfefb570657d3147b75619c4e25c104a48d4c795211c239765", + "newRequestProperties": [ + "body", + "requestFormId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.update_rule", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/automation/rules/{ruleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the selected rule's name, trigger, conditions and actions. Read the current rule first; explicitly supply null conditions/actions to clear them. The route determines the stored identifier." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9cb2954af965bef8734cd17ac5ccbdfc6f040db93e991e4778f9670cc6626bb3", + "newRequestProperties": [ + "body", + "ruleId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.workflow_metrics", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/metrics/workflows", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read workflow operational counters." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_automation.workflow_timeline", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/workflow-timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read independently persisted request workflow events, including provider execution identities and effects." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a45d3ae7091d129e9b2a30d7ed533d1a31ddfebfdb24b572afa57bde01b738ae", + "newRequestProperties": [ + "categories", + "correlationId", + "includePayload", + "page", + "pageSize", + "requestId", + "sinceUtc" + ], + "effect": "read", + "authority": "Request.Manager in the request organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_capabilities.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_capabilities.get", + "baselineContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the supported catalog revision and safety policy." + }, + "currentContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the supported catalog revision and safety policy." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_categories.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_categories.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/categories/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/categories/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e5af278af7c144fdce2abbb954a0e065fba87142ca9082e2e9e6073d93e06589", + "currentRequestSchemaSha256": "e5af278af7c144fdce2abbb954a0e065fba87142ca9082e2e9e6073d93e06589", + "newRequestProperties": [], + "effect": "read", + "authority": "TicketReadAccess: an Incident/Request/Change Read, Write, User or Manager grant, SelfService.User, or HelpdeskAdmin. Results are scoped to system/current tenant categories; allScopes=true or includeInactive=true additionally requires HelpdeskAdmin.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.add_worklog", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.add_worklog", + "baselineContract": { + "requestContract": "TicketWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/worklogs", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "add_worklog changes." + }, + "currentContract": { + "requestContract": "TicketWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/worklogs", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "add_worklog changes." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "7de1dd86895476bdacfe03853afb55d22ec3e5d1c91930c3b2352da5dbc086c3", + "currentRequestSchemaSha256": "7de1dd86895476bdacfe03853afb55d22ec3e5d1c91930c3b2352da5dbc086c3", + "newRequestProperties": [], + "effect": "write", + "authority": "Change.Write or Change.Manager authority in selected organization; draft edit lock and lifecycle invariants apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.assign", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.assign", + "baselineContract": { + "requestContract": "TicketAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign operation." + }, + "currentContract": { + "requestContract": "TicketAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "842827923aa61233aa4f64d5448bebd3d88feda547c9b1e73bf1926da6172a1d", + "currentRequestSchemaSha256": "842827923aa61233aa4f64d5448bebd3d88feda547c9b1e73bf1926da6172a1d", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.assign_self", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.assign_self", + "baselineContract": { + "requestContract": "ConfiguredAgentAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign_self operation." + }, + "currentContract": { + "requestContract": "ConfiguredAgentAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign_self operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "30ebfb7a4cc9a6ec6e8683a2e0cdcd6498f97ca3c1aed365b6c9ae11c2c38b35", + "currentRequestSchemaSha256": "30ebfb7a4cc9a6ec6e8683a2e0cdcd6498f97ca3c1aed365b6c9ae11c2c38b35", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.attachments_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.attachments_count", + "baselineContract": { + "requestContract": "ChangeCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read attachments_count for one change." + }, + "currentContract": { + "requestContract": "ChangeCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read attachments_count for one change." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "cc875cb7ce87f425fcef9c2c926476f9bd3fec679f581dbbeb998e22d5644dd9", + "currentRequestSchemaSha256": "cc875cb7ce87f425fcef9c2c926476f9bd3fec679f581dbbeb998e22d5644dd9", + "newRequestProperties": [], + "effect": "read", + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.bulk_create", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.bulk_create", + "baselineContract": { + "requestContract": "ChangeBulkCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_create operation." + }, + "currentContract": { + "requestContract": "ChangeBulkCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_create operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "be79296334f10556234d46e60e22996aa6ff3d59b37e56e2271789e20b3120d4", + "currentRequestSchemaSha256": "be79296334f10556234d46e60e22996aa6ff3d59b37e56e2271789e20b3120d4", + "newRequestProperties": [], + "effect": "write", + "authority": "Change.Write or Change.Manager authority in selected organization; draft edit lock and lifecycle invariants apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.bulk_state", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.bulk_state", + "baselineContract": { + "requestContract": "BulkTicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/bulk/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_state operation." + }, + "currentContract": { + "requestContract": "BulkTicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/bulk/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_state operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "7a5d5a7b3806022860520b6e8f54f389a80323ff152aff3a6c29206db976895e", + "currentRequestSchemaSha256": "7a5d5a7b3806022860520b6e8f54f389a80323ff152aff3a6c29206db976895e", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.create", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.create", + "baselineContract": { + "requestContract": "ChangeCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create changes." + }, + "currentContract": { + "requestContract": "ChangeCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create changes." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "12ca8c271900018bde9ae11ffccc0a71da5c2777511bccd36e8057b4f2c66222", + "currentRequestSchemaSha256": "12ca8c271900018bde9ae11ffccc0a71da5c2777511bccd36e8057b4f2c66222", + "newRequestProperties": [], + "effect": "write", + "authority": "Change.Write or Change.Manager authority in selected organization; draft edit lock and lifecycle invariants apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.delete", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.delete", + "baselineContract": { + "requestContract": "ChangeRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete changes." + }, + "currentContract": { + "requestContract": "ChangeRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete changes." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "fe0321856d0816a3e975e77a3e8343f1345a3dbc2bb86f26b803a3a51d429cc2", + "currentRequestSchemaSha256": "fe0321856d0816a3e975e77a3e8343f1345a3dbc2bb86f26b803a3a51d429cc2", + "newRequestProperties": [], + "effect": "write", + "authority": "Change.Delete or Change.Manager within the selected organization; Change.Write alone is insufficient", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.get", + "baselineContract": { + "requestContract": "ChangeRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get changes." + }, + "currentContract": { + "requestContract": "ChangeRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get changes." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "da155b1fffe3c9848e285f0d482650a719b1231dcbcafd23a6053813cc3a16fb", + "currentRequestSchemaSha256": "da155b1fffe3c9848e285f0d482650a719b1231dcbcafd23a6053813cc3a16fb", + "newRequestProperties": [], + "effect": "read", + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.lifecycle", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.lifecycle", + "baselineContract": { + "requestContract": "ChangeLifecycleRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/lifecycle", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "lifecycle changes." + }, + "currentContract": { + "requestContract": "ChangeLifecycleRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/lifecycle", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "lifecycle changes." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1364a04afbe32b11adf3161f16c094c04a8bb5729c6e3588c582ed5aca020551", + "currentRequestSchemaSha256": "1364a04afbe32b11adf3161f16c094c04a8bb5729c6e3588c582ed5aca020551", + "newRequestProperties": [], + "effect": "write", + "authority": "ApprovedForImplementation requires Change.Approve or Change.Manager; other transitions require Change.Write or Change.Manager, within the selected organization. API lifecycle rules apply.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "dcaa76efcf00151d520423322ac2a98c4558b9595d6f0e59b07f1e3abb6a6751", + "currentRequestSchemaSha256": "dcaa76efcf00151d520423322ac2a98c4558b9595d6f0e59b07f1e3abb6a6751", + "newRequestProperties": [], + "effect": "read", + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.listeners_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.listeners_count", + "baselineContract": { + "requestContract": "ChangeCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read listeners_count for one change." + }, + "currentContract": { + "requestContract": "ChangeCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read listeners_count for one change." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "48616b0970c4d5839a9c47a5af2f764b10c1228cfb6e1285cbbf2f9fbcb4e662", + "currentRequestSchemaSha256": "48616b0970c4d5839a9c47a5af2f764b10c1228cfb6e1285cbbf2f9fbcb4e662", + "newRequestProperties": [], + "effect": "read", + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.my_approval", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/approval/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the caller's designated change approval. An owner cannot substitute another approver's identity." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c476896b2e994402c94f6d5d7a4391f019c6dc4d635fbc8fd3ce471daffc13e2", + "newRequestProperties": [ + "changeId" + ], + "effect": "read", + "authority": "Stored designated approver identity and current change visibility or approval authority; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.review_approval", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/approval/review", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Review and approve the caller's own pending change approval. The last required review advances the change to ApprovedForImplementation and queues its timeline and notifications. Signed and authenticated decisions serialize together; a repeated committed review adds no duplicate effects. On 409 read my_approval before another action." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c476896b2e994402c94f6d5d7a4391f019c6dc4d635fbc8fd3ce471daffc13e2", + "newRequestProperties": [ + "changeId" + ], + "effect": "external_io", + "authority": "Stored designated approver identity and current change visibility or approval authority; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.state", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.state", + "baselineContract": { + "requestContract": "TicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "state changes." + }, + "currentContract": { + "requestContract": "TicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "state changes." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a12ed4542e95fe48a0e95dcff75320aabb97bd95acfcb21fab846a72001391c6", + "currentRequestSchemaSha256": "a12ed4542e95fe48a0e95dcff75320aabb97bd95acfcb21fab846a72001391c6", + "newRequestProperties": [], + "effect": "write", + "authority": "Change.Write or Change.Manager authority in selected organization; draft edit lock and lifecycle invariants apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.timeline", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.timeline", + "baselineContract": { + "requestContract": "ChangeRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility." + }, + "currentContract": { + "requestContract": "ChangeRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "642b8eca27898da8287e6761ddd8e79665ce2da87156b1b3fd0e9776c7b379a2", + "currentRequestSchemaSha256": "642b8eca27898da8287e6761ddd8e79665ce2da87156b1b3fd0e9776c7b379a2", + "newRequestProperties": [], + "effect": "read", + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.timeline_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.timeline_count", + "baselineContract": { + "requestContract": "ChangeCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read timeline_count for one change." + }, + "currentContract": { + "requestContract": "ChangeCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read timeline_count for one change." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c101d221f5093b33857ff6bea82b5f61631e12d67afd76702067436af98205ee", + "currentRequestSchemaSha256": "c101d221f5093b33857ff6bea82b5f61631e12d67afd76702067436af98205ee", + "newRequestProperties": [], + "effect": "read", + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.update", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.update", + "baselineContract": { + "requestContract": "ChangeUpdateRequest", + "method": "PUT", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update changes." + }, + "currentContract": { + "requestContract": "ChangeUpdateRequest", + "method": "PUT", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update changes." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e35ca9e7721f2b81dda2a234e062bc46eef13f662da428058a72cbc0ea974c1c", + "currentRequestSchemaSha256": "e35ca9e7721f2b81dda2a234e062bc46eef13f662da428058a72cbc0ea974c1c", + "newRequestProperties": [], + "effect": "write", + "authority": "Change.Write or Change.Manager authority in selected organization; draft edit lock and lifecycle invariants apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_changes.worklogs", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.worklogs", + "baselineContract": { + "requestContract": "ChangeRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/worklogs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "worklogs changes." + }, + "currentContract": { + "requestContract": "ChangeRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/worklogs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "worklogs changes." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9135d2d92b70ff7b399633b36d09bea6b2051c42eaf753037ab6e0931b8b9685", + "currentRequestSchemaSha256": "9135d2d92b70ff7b399633b36d09bea6b2051c42eaf753037ab6e0931b8b9685", + "newRequestProperties": [], + "effect": "read", + "authority": "Change read/write/manager permission or permitted owned change in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_config.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_config.get", + "baselineContract": { + "requestContract": "ConfigKeyRequest", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read an allowlisted persisted configuration value." + }, + "currentContract": { + "requestContract": "ConfigKeyRequest", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read an allowlisted persisted configuration value." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "2f063235da9d41967aae618e5b931f9057dc5b7f849edeab041db96411770264", + "currentRequestSchemaSha256": "2f063235da9d41967aae618e5b931f9057dc5b7f849edeab041db96411770264", + "newRequestProperties": [], + "effect": "read", + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_config.set", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_config.set", + "baselineContract": { + "requestContract": "ConfigValueRequest", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "local_write", + "readOnly": false, + "confirmationRequired": true, + "description": "Set an allowlisted non-secret configuration value." + }, + "currentContract": { + "requestContract": "ConfigValueRequest", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "local_write", + "readOnly": false, + "confirmationRequired": true, + "description": "Set an allowlisted non-secret configuration value." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "unavailable_by_policy_on_http", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "5870b2f9773b36c1acb971df21f03a42c1ebbc88652f0a4337b6fb1679f4127d", + "currentRequestSchemaSha256": "5870b2f9773b36c1acb971df21f03a42c1ebbc88652f0a4337b6fb1679f4127d", + "newRequestProperties": [], + "effect": "local_write", + "authority": "Local persisted non-secret configuration write; transport configuration surface must allow persistence", + "boundedIntegrationCredential": { + "support": "unavailable_by_policy_on_http", + "reason": "HTTP configuration surface is read-only. Local stdio persistence requires configurationWritesEnabled=true." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_config.show", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_config.show", + "baselineContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read redacted configuration." + }, + "currentContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read redacted configuration." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_config.unset", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_config.unset", + "baselineContract": { + "requestContract": "ConfigKeyRequest", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "local_write", + "readOnly": false, + "confirmationRequired": true, + "description": "Unset an allowlisted non-secret configuration value." + }, + "currentContract": { + "requestContract": "ConfigKeyRequest", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "local_write", + "readOnly": false, + "confirmationRequired": true, + "description": "Unset an allowlisted non-secret configuration value." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "unavailable_by_policy_on_http", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a56eab90b01ee13504b74c437efb9afeea24c18bde9f7cee7cc8d582f3593ec0", + "currentRequestSchemaSha256": "a56eab90b01ee13504b74c437efb9afeea24c18bde9f7cee7cc8d582f3593ec0", + "newRequestProperties": [], + "effect": "local_write", + "authority": "Local persisted non-secret configuration write; transport configuration surface must allow persistence", + "boundedIntegrationCredential": { + "support": "unavailable_by_policy_on_http", + "reason": "HTTP configuration surface is read-only. Local stdio persistence requires configurationWritesEnabled=true." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.confirm_netclaw_session_owner", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/legacy-sessions/confirm-owner", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Bind explicitly reviewed legacy conversation IDs to their actual historical Netclaw endpoint and instance. expectedEligibleConversations must equal the unique submitted IDs. The API compares current eligibility and commits its owner audit; reload on a conflict before submitting a new reviewed selection." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "94c086ba358ea93bf11a67f8640dc01b07f21d58f5a8e2076e38e8027bf91b84", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.delete_mapping", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/mappings/{mappingId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Remove one saved named mapping from the paired systems." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8ea9563a57448e08c8c3cb3c5d7430a4ffa560b89fa9e40a020df6a5ae83d182", + "newRequestProperties": [ + "mappingId", + "pairId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.delete_pair", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete a saved pair and its mappings through the supported cleanup lifecycle." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a93a708ce637c66585c9df9854e5187361fd8fe346bd8dd0dc43028488f9f1f4", + "newRequestProperties": [ + "pairId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.directory", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/directory", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read authorized organization, customer and provider-tenant choices for a saved pair." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a93a708ce637c66585c9df9854e5187361fd8fe346bd8dd0dc43028488f9f1f4", + "newRequestProperties": [ + "pairId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.generate_pairing_code", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/admin/system-connections/code", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Generate an expiring single-use system pairing code as a sensitive result. Deliver only to the authorized peer setup workflow; exclude it from campaign evidence and logs." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.incident_sources", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/integrations/netratel/sources/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List the configured incident receiver source namespaces, organization/customer targets, enabled state and revision." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.list", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/system-connections/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List saved system connections and their health without returning peer credentials." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.netclaw_settings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/netclaw/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved Netclaw connectivity metadata with secret-state flags." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.netclaw_unbound_sessions", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/netclaw/legacy-sessions/unbound", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the exact legacy conversation IDs, ticket and organization context that still need historical Netclaw provider ownership confirmation." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.pair", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/system-connections/pair", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Connect to an explicitly selected peer using its supplied short-lived write-only pairing code. Reuse the same operationId when reading the result of an uncertain attempt; the canonical signed peer protocol, address validation and owner checks apply." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a70dbaae415894c19917969c4b2e0631e0470970d2ab55b4e57fa6f7003235f3", + "newRequestProperties": [ + "body" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.pair_netclaw", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/pair-and-save", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Exchange a supplied one-time Netclaw pairing code, save the resulting protected device credential, and verify the authenticated session. Read netclaw_settings first and supply its current expectedRevision. If older unbound conversations exist, inspect netclaw_unbound_sessions and confirm their actual historical provider with confirm_netclaw_session_owner before pairing. On conflict or uncertain verification read the saved profile; a consumed pairing code must not be blindly replayed. Native Netclaw pairing requires its PostgreSQL durable-session capability." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c3429cf4aadbe31c628a66dd18076b78221129835ad7508460f258fa08553a2d", + "newRequestProperties": [ + "body" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.register_incident_source", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/integrations/netratel/sources/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Register a NetRatel source instance against an enabled organization/customer and an existing valid API-purpose credential. The API validates that credential's owner, organization, purpose, expiry and revocation; this operation does not issue a new credential." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "68e2b6bb6e8c1d8eb5bb566bfacc3409843c4d4699b041cdc24dbea97aeef511", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.save_mapping", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/mappings/{mappingId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Create or update a named organization/provider mapping on an existing securely paired peer. body.id must equal mappingId and body.pairId must equal pairId." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "3677a9a5250df6a612308b6d33363a62102b3e422e7bada1de5199cd83976c19", + "newRequestProperties": [ + "body", + "mappingId", + "pairId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.set_incident_source_credential", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/integrations/netratel/sources/{namespaceId}/principal-bindings/{credentialId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable or disable an explicitly selected API credential binding for a source namespace at its current expectedRevision. The API verifies active credentials belong to the source organization and persists the source audit." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "40f5d924e56d901ceaf61de6c63622f57e1fd743c118de2703f29a14984ef398", + "newRequestProperties": [ + "body", + "credentialId", + "namespaceId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.set_incident_source_state", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PATCH", + "pathTemplate": "/api/v1/integrations/netratel/sources/{namespaceId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable or disable a registered incident source at its currently read expectedRevision. Concurrent changes return conflict; read the source again before a reviewed update." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "37e825cbd351ff7833da23c654d85d2f9c30946bacf249c9db2ac99653f7cff2", + "newRequestProperties": [ + "body", + "namespaceId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.test_mapping", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/mappings/{mappingId}/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test the exact saved mapping's approved capabilities and organization binding." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8ea9563a57448e08c8c3cb3c5d7430a4ffa560b89fa9e40a020df6a5ae83d182", + "newRequestProperties": [ + "mappingId", + "pairId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.test_netclaw", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test the saved Netclaw connection and authenticated session protocol." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.test_netclaw_draft", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/test-draft", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test an explicit Netclaw settings draft through the authenticated session protocol without saving it. Omitted deviceToken retains the saved credential only where its endpoint binding matches. Read the saved profile and revision first." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9226997f78d3afd4dbd0b739076b3be64edfe3483222f1d4142b30992cafb278", + "newRequestProperties": [ + "body" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connections.update_netclaw_settings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/netclaw/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update Netclaw connectivity settings with optional write-only device-token replacement or explicit clearing. Omit the token to preserve its protected saved value. expectedRevision enforces concurrent-update detection." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9226997f78d3afd4dbd0b739076b3be64edfe3483222f1d4142b30992cafb278", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connectivity.orchestration", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connectivity.orchestration", + "baselineContract": { + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "orchestration operation." + }, + "currentContract": { + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "orchestration operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "999529a4d3fafcc549e1da54fb9e5533ce02459801b4806131914ff1947a665e", + "currentRequestSchemaSha256": "999529a4d3fafcc549e1da54fb9e5533ce02459801b4806131914ff1947a665e", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connectivity.orchestration_bindings", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connectivity.orchestration_bindings", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "orchestration_bindings operation." + }, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "orchestration_bindings operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connectivity.orchestration_jobs", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connectivity.orchestration_jobs", + "baselineContract": { + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/catalog/jobs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "orchestration_jobs operation." + }, + "currentContract": { + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/catalog/jobs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "orchestration_jobs operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e6702a985facf6fab0a19a362452dcfb6e84ce899b8f840d8f4fb3539fccf5b2", + "currentRequestSchemaSha256": "e6702a985facf6fab0a19a362452dcfb6e84ce899b8f840d8f4fb3539fccf5b2", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connectivity.orchestration_request_definitions", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connectivity.orchestration_request_definitions", + "baselineContract": { + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/catalog/request-definitions", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "orchestration_request_definitions operation." + }, + "currentContract": { + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/catalog/request-definitions", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "orchestration_request_definitions operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "85518a42d3451359a90a5482825db311b9b13a31a3863f4c48720145fac5c15f", + "currentRequestSchemaSha256": "85518a42d3451359a90a5482825db311b9b13a31a3863f4c48720145fac5c15f", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connectivity.orchestration_tenants", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connectivity.orchestration_tenants", + "baselineContract": { + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/catalog/tenants", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "orchestration_tenants operation." + }, + "currentContract": { + "requestContract": "OrchestrationSelectionRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/catalog/tenants", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "orchestration_tenants operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e15499f542cdebd1dd53bee182ab76cf12feb4717272ee520f8e9057230313fd", + "currentRequestSchemaSha256": "e15499f542cdebd1dd53bee182ab76cf12feb4717272ee520f8e9057230313fd", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_connectivity.orchestration_test", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connectivity.orchestration_test", + "baselineContract": { + "requestContract": "OrchestrationSelectionRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "orchestration_test operation." + }, + "currentContract": { + "requestContract": "OrchestrationSelectionRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "orchestration_test operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "36b6b0d03ea3b68a747aeeccab537775e3386d420d77054bf6c69ce0af746cba", + "currentRequestSchemaSha256": "36b6b0d03ea3b68a747aeeccab537775e3386d420d77054bf6c69ce0af746cba", + "newRequestProperties": [], + "effect": "external_io", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_customers.auth_status", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_customers.auth_status", + "baselineContract": { + "requestContract": "CustomerRequest", + "method": "GET", + "pathTemplate": "/api/v1/customers/{customerId}/auth/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "auth_status operation." + }, + "currentContract": { + "requestContract": "CustomerRequest", + "method": "GET", + "pathTemplate": "/api/v1/customers/{customerId}/auth/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "auth_status operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "prerequisites": { + "old": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Disposable existing customer and HelpdeskAdmin; configured supported authentication mode/provider. Invitations require isolated delivery capture for acceptance; Local/ambiguous identity and unavailable-provider results are distinct." + ], + "new": [ + "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", + "Existing customer and HelpdeskAdmin; inspect Local/External identity-provider mode and the account linkage before selecting an activation, invitation, enable/disable or synchronization operation." + ] + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "80e7d2acdb4a3c02f03c11241a104928ef6a17e50d724ef636bc5d5440aec851", + "currentRequestSchemaSha256": "80e7d2acdb4a3c02f03c11241a104928ef6a17e50d724ef636bc5d5440aec851", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_customers.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_customers.get", + "baselineContract": { + "requestContract": "CustomerRequest", + "method": "GET", + "pathTemplate": "/api/v1/customers/{customerId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "currentContract": { + "requestContract": "CustomerRequest", + "method": "GET", + "pathTemplate": "/api/v1/customers/{customerId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "43716bd4092be8631cf18ffb04e2a2bf8ca8671c0ad50822593d6ae592f6f718", + "currentRequestSchemaSha256": "43716bd4092be8631cf18ffb04e2a2bf8ca8671c0ad50822593d6ae592f6f718", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_customers.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_customers.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/customers/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/customers/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "df8a85e4194a3ef488e8723fd153a0d16ab1fa898a3c69dc948621836b812fc6", + "currentRequestSchemaSha256": "df8a85e4194a3ef488e8723fd153a0d16ab1fa898a3c69dc948621836b812fc6", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.create", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a dataset with typed columns and explicit organization scope. Non-administrators remain restricted to custom sources." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "cabb40a78a210c303a4a05b2811398ee23987bcb244074f5d0f4bd6801d14b68", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.create_credential", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/credentials", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create one dataset ingestion credential. Its plaintext key is returned once to this authenticated creation request; subsequent credential reads return metadata only." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a73707cf4a9e3d682723113c869c0f57ef2715751df6538fca480b79d91e7af3", + "newRequestProperties": [ + "body", + "datasetId" + ], + "effect": "write", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.credentials", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/credentials", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read dataset ingestion credential metadata without secret keys." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "54b9139ccae85e80ecf678bbf49d34aa607c2e111859bc26ea7eef3704452354", + "newRequestProperties": [ + "datasetId" + ], + "effect": "read", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.delete", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one authorized dataset through the canonical service." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "54b9139ccae85e80ecf678bbf49d34aa607c2e111859bc26ea7eef3704452354", + "newRequestProperties": [ + "datasetId" + ], + "effect": "write", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.get", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read an authorized dataset definition and schema." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "54b9139ccae85e80ecf678bbf49d34aa607c2e111859bc26ea7eef3704452354", + "newRequestProperties": [ + "datasetId" + ], + "effect": "read", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.graph_settings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/graph-settings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read Graph dataset configuration and synchronization diagnostics without stored secrets." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "231b58899eaad218374588b7f5fb49062f3dc898173989d82a324a0066c9f6d4", + "newRequestProperties": [ + "organizationId" + ], + "effect": "read", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.list", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List datasets in the explicitly selected authorized organization." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "231b58899eaad218374588b7f5fb49062f3dc898173989d82a324a0066c9f6d4", + "newRequestProperties": [ + "organizationId" + ], + "effect": "read", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.options", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/datasets/{datasetId}/options", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read authorized searchable dataset options for self-service form inputs." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "5742c94998f1fdbc9959664c67de25b86f6909a4bee0917324701405a6fcaa89", + "newRequestProperties": [ + "datasetId", + "page", + "pageSize", + "query" + ], + "effect": "read", + "authority": "SelfService.User in the dataset organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.revoke_credential", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/credentials/{credentialId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Revoke one ingestion credential under the dataset's API-management authority." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "92941ab6315103ac28ba97ea1aced2011a67937644def2ce0048702857daed85", + "newRequestProperties": [ + "credentialId", + "datasetId" + ], + "effect": "write", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.rows", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/rows", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded, searchable dataset rows." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "292132b2b9c1c333bb74852754aa6293bd2db53441d79878e5ea50c5325a1192", + "newRequestProperties": [ + "datasetId", + "page", + "pageSize", + "query" + ], + "effect": "read", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.save_graph_settings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/resources/datasets/graph-settings", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Save Graph dataset configuration, a write-only client secret and schedule controls. Omit or leave clientSecret empty to preserve its existing protected value." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c0595a90b41f9606bc92d6800fe4f067f649970d7cb421786f5fe28c88a29d14", + "newRequestProperties": [ + "body" + ], + "effect": "external_io", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.sync_graph", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/graph-settings/{organizationId}/sync", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Synchronize enabled built-in datasets through the saved Graph integration." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", + "newRequestProperties": [ + "organizationId" + ], + "effect": "external_io", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.update", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update a dataset definition within its actual stored organization scope." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "b3120600937f664129eddb000ca70dc67279b69ce7d0678ae236ba5e86439ce7", + "newRequestProperties": [ + "body", + "datasetId" + ], + "effect": "write", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_datasets.upsert_rows", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/rows", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update up to 100 dataset rows using the authenticated operator's actual organization authority. Set deleteMissing explicitly; true removes existing rows omitted from this selected update. The separate ingestion API-key contract remains unchanged." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "cc05e509a40df5d7ecd7ba739b9a7ca8186b2ebc5649c82d9e1b0eae7294fc6d", + "newRequestProperties": [ + "body", + "datasetId" + ], + "effect": "write", + "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.archive", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/archive", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Archive a mailbox using its current version and explicit confirmation. This changes organization routing through the same canonical transaction used by the UI." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "87433b39140a712152fe4f47823d4d424257cd5f71eaa63ea85a75dcdc833ad9", + "newRequestProperties": [ + "body", + "mailboxId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.create", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a mailbox with explicitly supplied write-only credentials. Credential values never appear in the preview or normal readback; create does not import mail implicitly." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "3a08535b53e6b39bda26b731d77cf42babbb8439c60c644745f36d0811737c84", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.create_layout", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-layouts/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a custom email layout with canonical HTML sanitization." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "6a696bb8c84e994aed970df13acb6160cd4720c8bf7d04da1b9ec1cf85af2847", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.create_rule", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a typed inbound mail rule, including authorized forwarded-sender processing; configured tenant/mailbox checks remain enforced." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "2e37c00c71d0c0cc8a94fb745c1e77230b586f781e7ada6e168910714d8bbe0e", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.create_template", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-templates/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a custom email template using the canonical HTML sanitizer." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "04131e4ce9e7ecf1cb69bff621169f9ee983292802498f50b3fba2fa32147424", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.delete_layout", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/email-layouts/{layoutId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one custom layout; protected system layouts remain undeletable." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "d5fedca1802d8965256f37d9b1647955b5ba806302d5a26a8b5defe76f1766e6", + "newRequestProperties": [ + "layoutId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.delete_template", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/email-templates/{templateId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete a custom template; protected system templates remain undeletable." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "90a7a83b9255e18243e1bc92c9dc5f2c44327c31fc0c7d8b29255284f31f24de", + "newRequestProperties": [ + "templateId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.diagnostics", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/diagnostics", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded mailbox receipt, cursor and worker diagnostics without secrets." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", + "newRequestProperties": [ + "mailboxId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.disable", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/disable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Disable one saved mailbox without deleting its history or credentials." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", + "newRequestProperties": [ + "mailboxId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.disable_rule", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}/disable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Disable one inbound rule while retaining its audit history." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", + "newRequestProperties": [ + "ruleId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.effective", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/effective", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read each organization's effective dedicated or inherited mailbox route." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.enable", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/enable", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable one saved mailbox through its canonical readiness and credential checks." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", + "newRequestProperties": [ + "mailboxId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.enable_rule", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}/enable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable one inbound rule after canonical binding validation." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", + "newRequestProperties": [ + "ruleId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.get", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/{mailboxId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one saved mailbox configuration and its concurrency version." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", + "newRequestProperties": [ + "mailboxId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.get_rule", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read an inbound email rule including its typed conditions and actions." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", + "newRequestProperties": [ + "ruleId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.historical_import", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/historical/import", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Queue only the explicitly confirmed historical receipt selection. Import eligibility, duplicates and mailbox state remain server-validated." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "386db33f41d0aac823715310a0c6b342fc3cb7f449f456f07eae41681156e3c7", + "newRequestProperties": [ + "body", + "mailboxId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.historical_preview", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/historical/preview", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Inspect 1–50 eligible historical mailbox messages without importing them; retain the returned receipt identities for a selected import." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "d76167947d229bd74f5c3f156cb99149cce13092d1c969983b15ca3899b050ca", + "newRequestProperties": [ + "body", + "mailboxId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.layout_choices", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-layouts/choices", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read selectable system and current-tenant email layouts." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.layouts", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-layouts/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved email layouts, optionally scoped to an integer tenant ID." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "099c62e8951860a29d7e9ef2f4f36108a5d0cc1881ea22cde8df7a9c5635fe76", + "newRequestProperties": [ + "tenantId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.list", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved mailbox settings with stored secrets redacted by the API." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.outgoing", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the mailbox's outgoing sender configuration and version with credentials redacted." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", + "newRequestProperties": [ + "mailboxId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.preview_template", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-templates/preview", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Render a saved or draft email template using a selected tenant's branding without sending a message." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "e4cb13626aa6cb9bb07c1deed0e914b1d2e5f7cbdaab5a82b9ba1a60834baccf", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.reorder_rules", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/reorder", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Reorder an explicitly selected distinct set of rules in one tenant/mailbox scope." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "6bccd032016ada4c9f0c96cdeadeda2e1a3fa55bbb9156f209d8ad5ec5a69ee5", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.retry_receipt", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/receipts/{receiptId}/retry", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Queue retry of one eligible inbound receipt. The server checks outcome eligibility and concurrent changes." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "5786b3dd195ffc67377adef45d3de23ec9ec77441f66c132f752f9d9eb71163f", + "newRequestProperties": [ + "mailboxId", + "receiptId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.rule_audit", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/inbound-email-rules/audit", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read up to 200 inbound rule processing outcomes filtered by ticket, message, tenant or mailbox." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "198711e71b95287926112135ef9c985cde9185ca77c352fd88d3deb2340b1054", + "newRequestProperties": [ + "mailboxId", + "messageId", + "tenantId", + "ticketId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.rules", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/inbound-email-rules/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List inbound routing rules for a tenant and/or mailbox." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "259284401dc6ef0624e3d3bfd99a967f4742e8e588437adbe7e8b84ccfdb13cb", + "newRequestProperties": [ + "mailboxId", + "tenantId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.save_outgoing", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Save complete outgoing sender configuration with optimistic concurrency. Supply smtpPassword as an empty string to retain its saved value, a new write-only value to rotate it, or clearSmtpPassword=true to remove it." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "2cae3879d4dbead0d1c0759b99dfe4c05dfa754148fb5b837092224190c0afd2", + "newRequestProperties": [ + "body", + "mailboxId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.send_test", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing/send-test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Send one explicitly confirmed sample message to one recipient using the saved sender. Acceptance by the provider is reported separately from final delivery." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "75882743e8e02a11893576507c1ba2a70dbb6d25c73d8a7fd40ae6859a11f517", + "newRequestProperties": [ + "body", + "mailboxId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.set_worker", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/worker", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Persist an explicitly confirmed mailbox worker run/pause decision. Deployment-level disabled ingestion remains authoritative." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9bb0272371242ffc1451c90c80949a96e259f6760f2220243432ea1b5d8daf3e", + "newRequestProperties": [ + "body" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.sync", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/sync", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Queue a sync of one configured mailbox and report queued versus unavailable state." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", + "newRequestProperties": [ + "mailboxId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.templates", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-templates/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved email templates." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.test_draft_mailbox", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test explicitly supplied draft mailbox settings and write-only credentials without saving the configuration or importing mail." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "3a08535b53e6b39bda26b731d77cf42babbb8439c60c644745f36d0811737c84", + "newRequestProperties": [ + "body" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.test_mailbox", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test a saved inbound mailbox configuration and retain its test result against the saved revision." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", + "newRequestProperties": [ + "mailboxId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.test_outgoing", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test authentication of the saved outgoing transport and record the tested revision." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", + "newRequestProperties": [ + "mailboxId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.update", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-settings/{mailboxId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Save the complete mailbox configuration using the current version. Secret fields are write-only; omitted or empty values preserve saved secrets unless the corresponding clear flag is true." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "ac705ca7c60bc1074b2d3c7770c633716a520b6ed19c5abdf2b83bb7e6d713f3", + "newRequestProperties": [ + "body", + "mailboxId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.update_layout", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-layouts/{layoutId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update layout content while preserving identity and system protection." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "40969a874e07202431c87bbd6801794b3067a65fdab06fbd886005389aeb3324", + "newRequestProperties": [ + "body", + "layoutId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.update_rule", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the typed settings of one inbound email rule." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "ea979a1a73deb014629beb2cc8aa7279e0d4b849194ef9c7aa210f17470ceafc", + "newRequestProperties": [ + "body", + "ruleId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.update_template", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-templates/{templateId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update template content while the API preserves identity and increments its version." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "7f86b975c3aaa694535fd116c22f13138ef9473dfb4dda22d729efef8d5ed19b", + "newRequestProperties": [ + "body", + "templateId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.upload_template_image", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-templates/{templateName}/images", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Upload one inline template image, at most 1 MiB, through the authenticated multipart endpoint and return its stored image URL." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "d63f76add2f83ac2653fec60c6989f102fb4c58675ec31b8754b8fe7f16522c8", + "newRequestProperties": [ + "body", + "templateName" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.worker_status", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/worker", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the persisted instance mailbox worker decision and deployment-level ingestion status." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_enums.change_lifecycle_state", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_enums.change_lifecycle_state", + "baselineContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enum metadata." + }, + "currentContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enum metadata." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_enums.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_enums.list", + "baselineContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enum metadata." + }, + "currentContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enum metadata." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_enums.request_task_status", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_enums.request_task_status", + "baselineContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enum metadata." + }, + "currentContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enum metadata." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_enums.ticket_priority", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_enums.ticket_priority", + "baselineContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enum metadata." + }, + "currentContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enum metadata." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_enums.ticket_state", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_enums.ticket_state", + "baselineContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enum metadata." + }, + "currentContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enum metadata." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_examples.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_examples.list", + "baselineContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read operator examples." + }, + "currentContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read operator examples." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_health.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_health.get", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/health/live, /health/ready, /api/v1/auth/ai-agent/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read live, ready, and authenticated health." + }, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/health/live, /health/ready, /api/v1/auth/ai-agent/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read live, ready, and authenticated health." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Backend live/ready probes are public; authenticated probe uses /auth/me for caller-bound integration/gateway or exact AuthentikAiAgent status for explicit external Authentik. MCP ingress still requires its configured identity.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.add_worklog", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.add_worklog", + "baselineContract": { + "requestContract": "IncidentWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/worklogs", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "add_worklog incidents." + }, + "currentContract": { + "requestContract": "IncidentWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/worklogs", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "add_worklog incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1a495b580311ffc63dba33cc47b239316762e5d83e21bb57dd90a74a87c4f672", + "currentRequestSchemaSha256": "1a495b580311ffc63dba33cc47b239316762e5d83e21bb57dd90a74a87c4f672", + "newRequestProperties": [], + "effect": "write", + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.assign", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.assign", + "baselineContract": { + "requestContract": "TicketAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign incidents." + }, + "currentContract": { + "requestContract": "TicketAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d9a7a076c4270fd4f691aa95fb149cefa06159991723376e2639544843cac37b", + "currentRequestSchemaSha256": "d9a7a076c4270fd4f691aa95fb149cefa06159991723376e2639544843cac37b", + "newRequestProperties": [], + "effect": "write", + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.assign_self", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.assign_self", + "baselineContract": { + "requestContract": "ConfiguredAgentAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign_self incidents." + }, + "currentContract": { + "requestContract": "ConfiguredAgentAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign_self incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "3000a32784ac81322d04755acc66a6ccb883e342b29a136ba1aa71d98edda7bb", + "currentRequestSchemaSha256": "3000a32784ac81322d04755acc66a6ccb883e342b29a136ba1aa71d98edda7bb", + "newRequestProperties": [], + "effect": "write", + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.attachments_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.attachments_count", + "baselineContract": { + "requestContract": "IncidentCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read attachments_count for one incident." + }, + "currentContract": { + "requestContract": "IncidentCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read attachments_count for one incident." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "7240994ac58ed328fb71d3aa6f64c81332edf14601b873e4336316cb2d3d526e", + "currentRequestSchemaSha256": "7240994ac58ed328fb71d3aa6f64c81332edf14601b873e4336316cb2d3d526e", + "newRequestProperties": [], + "effect": "read", + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.bulk_create", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.bulk_create", + "baselineContract": { + "requestContract": "IncidentBulkCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_create incidents." + }, + "currentContract": { + "requestContract": "IncidentBulkCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_create incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "dc7bd7a018498fefb6733ce84c1872459ffd75a160086cf2045ee2d4ab5d1b11", + "currentRequestSchemaSha256": "dc7bd7a018498fefb6733ce84c1872459ffd75a160086cf2045ee2d4ab5d1b11", + "newRequestProperties": [], + "effect": "write", + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.bulk_delete", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/delete", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Permanently delete 1–100 explicitly selected incidents through the canonical silent deletion action. Requesters are not notified. Check deleted and missing counts and read back the selected IDs before repeating an uncertain batch." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "0a5726c2d6501ea724286c0cc73699fcff736c2ba235f89576bfc142eab4725b", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "Incident deletion authority for every selected incident; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.bulk_marketing_spam", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/marketing-spam", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Silently resolve 1–100 explicitly selected incidents, complete their SLA, and exclude them from requester outbound email as marketing or spam. Check updated and missing counts and read back the selected incidents." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "0a5726c2d6501ea724286c0cc73699fcff736c2ba235f89576bfc142eab4725b", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "Incident.Manager for every selected incident or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.bulk_state", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.bulk_state", + "baselineContract": { + "requestContract": "BulkTicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_state incidents." + }, + "currentContract": { + "requestContract": "BulkTicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_state incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "96fba8395ba5f1f1e06c502db786cf9207c334a5b8e31fc74d12935f00f44892", + "currentRequestSchemaSha256": "96fba8395ba5f1f1e06c502db786cf9207c334a5b8e31fc74d12935f00f44892", + "newRequestProperties": [], + "effect": "write", + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.close", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.close", + "baselineContract": { + "requestContract": "IncidentCloseRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/worklogs then /state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "close incidents." + }, + "currentContract": { + "requestContract": "IncidentCloseRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/worklogs then /state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "close incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "093825c1798d368403227679872767a49bab77189d391f23f56b0e7e2c9ef3e5", + "currentRequestSchemaSha256": "093825c1798d368403227679872767a49bab77189d391f23f56b0e7e2c9ef3e5", + "newRequestProperties": [], + "effect": "write", + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.create", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.create", + "baselineContract": { + "requestContract": "IncidentCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create incidents." + }, + "currentContract": { + "requestContract": "IncidentCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "40823a916ac65a0412463c4affce326b78f1f1a7944028d8416222a7e33d3fb0", + "currentRequestSchemaSha256": "40823a916ac65a0412463c4affce326b78f1f1a7944028d8416222a7e33d3fb0", + "newRequestProperties": [], + "effect": "write", + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.create_relation", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/relations", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Link two incidents in the same organization and copy source listeners to the target. relationType 0 means DuplicateOf and always resolves the source; 1 means RelatedTo and follows the explicit closeSourceTicket choice. Closing completes the source SLA and publishes the canonical event. Read both incidents and relations after an uncertain result before another attempt; an existing identical relation returns 409." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "f76e4512ff535599fdf57eff72124158fcd216d6fb8bb615fd345da3bab34b24", + "newRequestProperties": [ + "body", + "incidentId" + ], + "effect": "external_io", + "authority": "Incident.Manager in both incident organizations or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.delete", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.delete", + "baselineContract": { + "requestContract": "IncidentRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete incidents." + }, + "currentContract": { + "requestContract": "IncidentRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d0f9bfcb1984178e4f6df525891b0cfde826ab480a263634af40a94ff4cb2075", + "currentRequestSchemaSha256": "d0f9bfcb1984178e4f6df525891b0cfde826ab480a263634af40a94ff4cb2075", + "newRequestProperties": [], + "effect": "write", + "authority": "Incident.Delete or Incident.Manager within the selected organization; Incident.Write alone is insufficient", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.delete_relation", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/incidents/{incidentId}/relations/{relationId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Remove the selected relationship after reading its UUID. This removes only the link; it does not reopen the source or remove listeners already copied to the target." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c8fa7fe4a04d24453839d3e527e70affefeb32917c389154acccaf9304fac47d", + "newRequestProperties": [ + "incidentId", + "relationId" + ], + "effect": "write", + "authority": "Incident.Manager for both related incidents or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.get", + "baselineContract": { + "requestContract": "IncidentRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get incidents." + }, + "currentContract": { + "requestContract": "IncidentRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9195222a85256812bfcfce974a33b4c89dd8f0482982911d60a6170a1d8845a2", + "currentRequestSchemaSha256": "9195222a85256812bfcfce974a33b4c89dd8f0482982911d60a6170a1d8845a2", + "newRequestProperties": [], + "effect": "read", + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "586f9bd0782de3a389f2012209c96123ce1aca093afc151122f8bf8ef56d6dcd", + "currentRequestSchemaSha256": "586f9bd0782de3a389f2012209c96123ce1aca093afc151122f8bf8ef56d6dcd", + "newRequestProperties": [], + "effect": "read", + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.listeners_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.listeners_count", + "baselineContract": { + "requestContract": "IncidentCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read listeners_count for one incident." + }, + "currentContract": { + "requestContract": "IncidentCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read listeners_count for one incident." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e32a19546b402223e72fc5f9dc4d4afbec79bcc49dfb65ba807b9529e4f97aaa", + "currentRequestSchemaSha256": "e32a19546b402223e72fc5f9dc4d4afbec79bcc49dfb65ba807b9529e4f97aaa", + "newRequestProperties": [], + "effect": "read", + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.peek", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.peek", + "baselineContract": { + "requestContract": "IncidentRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/peek", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "peek incidents." + }, + "currentContract": { + "requestContract": "IncidentRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/peek", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "peek incidents." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ec302a1a46fa69dc368028d798b57bd308a758b3e178f92e7fcf2ef7855d3d57", + "currentRequestSchemaSha256": "ec302a1a46fa69dc368028d798b57bd308a758b3e178f92e7fcf2ef7855d3d57", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.relations", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/relations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the current incident's duplicate and related links. Links to incidents outside the caller's visibility are excluded." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "5aa90f282e330d4f89c878c47ba5549a401e6da824ca4e66e6914877bb367ea8", + "newRequestProperties": [ + "incidentId" + ], + "effect": "read", + "authority": "Visibility of both related incidents; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.state", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.state", + "baselineContract": { + "requestContract": "TicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "state incidents." + }, + "currentContract": { + "requestContract": "TicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "state incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "14c0a7906b404636b8a94c230c7451ea3f6dc234842bf8dfc5fb58affd8cdfd2", + "currentRequestSchemaSha256": "14c0a7906b404636b8a94c230c7451ea3f6dc234842bf8dfc5fb58affd8cdfd2", + "newRequestProperties": [], + "effect": "write", + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.timeline", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.timeline", + "baselineContract": { + "requestContract": "IncidentRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility." + }, + "currentContract": { + "requestContract": "IncidentRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "3f4c9c7ca50e80dd99f6ed82f93212ad9f6024ae8ff9ddacfdc2bff5d3c3f5cf", + "currentRequestSchemaSha256": "3f4c9c7ca50e80dd99f6ed82f93212ad9f6024ae8ff9ddacfdc2bff5d3c3f5cf", + "newRequestProperties": [], + "effect": "read", + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.timeline_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.timeline_count", + "baselineContract": { + "requestContract": "IncidentCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read timeline_count for one incident." + }, + "currentContract": { + "requestContract": "IncidentCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read timeline_count for one incident." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "51d726a2db4b6fda3073a0562c3f580db364219286cccccc57a523e672b6bbcd", + "currentRequestSchemaSha256": "51d726a2db4b6fda3073a0562c3f580db364219286cccccc57a523e672b6bbcd", + "newRequestProperties": [], + "effect": "read", + "authority": "Incident read/write/manager permission or permitted owned incident in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_incidents.update", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.update", + "baselineContract": { + "requestContract": "IncidentUpdateRequest", + "method": "PUT", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update incidents." + }, + "currentContract": { + "requestContract": "IncidentUpdateRequest", + "method": "PUT", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update incidents." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e7a985caa08e8b6586861279c0ab558cee2b7d60ac532e14560293139197cbde", + "currentRequestSchemaSha256": "e7a985caa08e8b6586861279c0ab558cee2b7d60ac532e14560293139197cbde", + "newRequestProperties": [], + "effect": "write", + "authority": "Incident management/write authority in selected organization; API action-specific policy applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_logs.search", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_logs.search", + "baselineContract": { + "requestContract": "LogSearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/ai-agent/logs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Run a bounded, redacted log search." + }, + "currentContract": { + "requestContract": "LogSearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/ai-agent/logs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Run a bounded, redacted log search." + }, + "changes": { + "authority": { + "old": "Exact AuthentikAiAgent authentication scheme; ordinary integration/gateway identities are denied by policy regardless of scoped grants", + "new": "Exact AuthentikAiAgent scheme or explicit current administrator mcp-owner grant; ordinary scoped integration/gateway identities are denied regardless of scoped grants" + }, + "boundedIntegrationCredential": { + "old": { + "support": "denied_by_policy", + "reason": "The exact AuthentikAiAgent API authentication scheme is required. Ordinary integration credentials and gateway execution tokens cannot satisfy it, regardless of scoped grants. Explicit external Authentik downstream identity is supported; never switch modes as fallback." + }, + "new": { + "support": "denied_by_policy", + "reason": "Ordinary scoped credentials cannot satisfy agent-operation authority. An explicitly approved mcp-owner grant or the exact external AuthentikAiAgent scheme is required; invocation and ticket binding remain authoritative." + } + }, + "credentialModes": { + "old": [ + "explicit external Authentik downstream identity satisfying exact AuthentikAiAgent scheme" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik downstream identity satisfying exact AuthentikAiAgent scheme" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "350c9565e3dbc778fcc185e8298b237aa5edc86705aaebe042d50e03ffdf94c9", + "currentRequestSchemaSha256": "350c9565e3dbc778fcc185e8298b237aa5edc86705aaebe042d50e03ffdf94c9", + "newRequestProperties": [], + "effect": "read", + "authority": "Exact AuthentikAiAgent scheme or explicit current administrator mcp-owner grant; ordinary scoped integration/gateway identities are denied regardless of scoped grants", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "Ordinary scoped credentials cannot satisfy agent-operation authority. An explicitly approved mcp-owner grant or the exact external AuthentikAiAgent scheme is required; invocation and ticket binding remain authoritative." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.changed_route_preview", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/{deliveryId}/changed-route-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the old and current sender routes and all revisions before approving a route change." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", + "newRequestProperties": [ + "deliveryId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.failed", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/timeline/failed", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read up to 100 failed delivery events including retry eligibility and recipient outcome evidence." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.outgoing_retry_preview", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/{deliveryId}/outgoing-retry-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the current outgoing revision and fence required before retrying a reviewed sender configuration." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", + "newRequestProperties": [ + "deliveryId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.pending", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/pending", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Search pending deliveries with bounded paging, status, recipient and organization filters. Delivery state is distinct from queue acceptance." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "652a87b375ac5295fdba4e89cdf840af5d54509d526639656917bf245ee4cdc3", + "newRequestProperties": [ + "descending", + "from", + "organizationId", + "page", + "pageSize", + "reason", + "recipient", + "search", + "sender", + "sort", + "status", + "to" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.pending_actions", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/pending/actions", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Apply retry, cancel or remove to 1–100 explicitly selected delivery IDs with a recorded reason. The API reauthorizes and reports each result independently." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "ef19fd59602be26f8f27d0a7839106552f6bb1e3285b4cdc2f0d1098fd19e5ad", + "newRequestProperties": [ + "body" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.pending_count", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/timeline/pending-count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the number of failed deliveries awaiting review or retry." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.pending_organizations", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/pending/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Look up organizations for pending-delivery filtering; returns at most 50 matches." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "58a948cb667ccb66efd9906d31b3557fc22d5e3490e1b213f4ec8d13c4aeb6d3", + "newRequestProperties": [ + "id", + "q", + "take" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.retry", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Retry one eligible failed delivery. Uncertain, partially accepted or changed-sender deliveries require their separate reviewed retry operation." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", + "newRequestProperties": [ + "deliveryId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.retry_confirmed_undelivered", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry-confirmed-undelivered", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Retry an uncertain delivery only after independent evidence confirms no delivery. The API retains evidence, outcome and fence checks." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "806c1b237df5d50e7e6cc374244f0138e3e02e2b9b429b37afda0b11d5e48f6f", + "newRequestProperties": [ + "body", + "deliveryId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.retry_current_outgoing", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry-current-outgoing", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Retry using the reviewed outgoing configuration with its expected revisions and fence. Preserve the preview values in the request." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "4acc1655933e6bc7a5dba670109f84e38daf6300e333a52397e19e9d1c0068e0", + "newRequestProperties": [ + "body", + "deliveryId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.retry_current_route", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry-current-route", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Retry with an explicitly reviewed new sender using the exact route-preview identifiers and revisions." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "30ef4807b7bf87441f8e78137857ab6290ea29281f460284dbce7e02a9a85390", + "newRequestProperties": [ + "body", + "deliveryId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.send", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email/send", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Send an administrator-authored message through the configured mail service to explicitly supplied recipients. For ticket replies use the ticket add_worklog operation with isInternalNote=false." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8f6e346478b8c8aae64cc088174f70b9cb9dc8fd3734736b37c8b17b98c47d8a", + "newRequestProperties": [ + "body" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.test_provider", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/email/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test availability of the configured email provider." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_mail.uncertain_retry_preview", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/{deliveryId}/uncertain-retry-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read an uncertain delivery's current fence, sender and recipients before independently establishing whether delivery occurred." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", + "newRequestProperties": [ + "deliveryId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_notifications.error_summary", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/notifications/error-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the caller's authorized error notification counters." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "NotificationAccess and current recipient visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_notifications.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_notifications.get", + "baselineContract": { + "requestContract": "NotificationRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/{notificationId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "currentContract": { + "requestContract": "NotificationRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/{notificationId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9625d149e0ff898eb9a81992ba476e29721fd07b9d29a0d6586560cb4ac3e45f", + "currentRequestSchemaSha256": "9625d149e0ff898eb9a81992ba476e29721fd07b9d29a0d6586560cb4ac3e45f", + "newRequestProperties": [], + "effect": "read", + "authority": "Authenticated NotificationAccess plus resolved application user ID. Personal referenced-ticket notices require current ticket ownership/module scope; broadcasts require matching tenant module scope (unclassified notices require all module scopes). HelpdeskAdmin sees all. summary/unread_errors use the same visible set; unread_errors adds unread Error/Critical filtering.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_notifications.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_notifications.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "417baa9d661cac4419720b0ee7982d7c29282403c68109c777e174940f0bd46a", + "currentRequestSchemaSha256": "417baa9d661cac4419720b0ee7982d7c29282403c68109c777e174940f0bd46a", + "newRequestProperties": [], + "effect": "read", + "authority": "Authenticated NotificationAccess plus resolved application user ID. Personal referenced-ticket notices require current ticket ownership/module scope; broadcasts require matching tenant module scope (unclassified notices require all module scopes). HelpdeskAdmin sees all. summary/unread_errors use the same visible set; unread_errors adds unread Error/Critical filtering.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_notifications.mark_read", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_notifications.mark_read", + "baselineContract": { + "requestContract": "NotificationMarkReadRequest", + "method": "POST", + "pathTemplate": "/api/v1/notifications/mark-read", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "mark_read operation." + }, + "currentContract": { + "requestContract": "NotificationMarkReadRequest", + "method": "POST", + "pathTemplate": "/api/v1/notifications/mark-read", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "mark_read operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "7e4dc2e9f1c672d8e8c4918ccf16ff14660d2f78ebb47a7f65008994f0d52f46", + "currentRequestSchemaSha256": "7e4dc2e9f1c672d8e8c4918ccf16ff14660d2f78ebb47a7f65008994f0d52f46", + "newRequestProperties": [], + "effect": "write", + "authority": "Authenticated NotificationAccess plus resolved application user ID. Only currently visible notification IDs may be marked; personal notices must belong to that user, global reads create that user's own marker. updated=0 is a no-op.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_notifications.summary", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_notifications.summary", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/notifications/summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read total, unread and unread Error/Critical counts for the actor's complete authorized notification population." + }, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/notifications/summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read total, unread and unread Error/Critical counts for the actor's complete authorized notification population." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Authenticated NotificationAccess plus resolved application user ID. Personal referenced-ticket notices require current ticket ownership/module scope; broadcasts require matching tenant module scope (unclassified notices require all module scopes). HelpdeskAdmin sees all. summary/unread_errors use the same visible set; unread_errors adds unread Error/Critical filtering.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_notifications.timeline", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read persisted DomainEvent notifications for a reference, correlationId or both, with bounded output. At least one selector must contain non-whitespace text." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "e90b1b807225ecbb8c4122d1572b8e31b09bc89bafc938b04ad69706c5fea775", + "newRequestProperties": [ + "correlationId", + "reference", + "take", + "tenantId" + ], + "effect": "read", + "authority": "NotificationAccess and current recipient/organization visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_notifications.unread", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/unread", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one bounded page of the caller's unread notifications." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "b7182b9fa08fc69c4630be95280a4a83d84189fc52a5d5926e364223bb8fe478", + "newRequestProperties": [ + "page", + "pageSize" + ], + "effect": "read", + "authority": "NotificationAccess and current recipient visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_notifications.unread_errors", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_notifications.unread_errors", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/unread-errors", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "unread_errors operation." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/unread-errors", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "unread_errors operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "94b63698f157a56b423f74788905dd7fff847a1b59572ab9aa847ac172720c0a", + "currentRequestSchemaSha256": "94b63698f157a56b423f74788905dd7fff847a1b59572ab9aa847ac172720c0a", + "newRequestProperties": [], + "effect": "read", + "authority": "Authenticated NotificationAccess plus resolved application user ID. Personal referenced-ticket notices require current ticket ownership/module scope; broadcasts require matching tenant module scope (unclassified notices require all module scopes). HelpdeskAdmin sees all. summary/unread_errors use the same visible set; unread_errors adds unread Error/Critical filtering.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_organizations.change_participants", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_organizations.change_participants", + "baselineContract": { + "requestContract": "OrganizationRequest", + "method": "GET", + "pathTemplate": "/api/v1/organizations/{organizationId}/change-participants", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "change_participants operation." + }, + "currentContract": { + "requestContract": "OrganizationRequest", + "method": "GET", + "pathTemplate": "/api/v1/organizations/{organizationId}/change-participants", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "change_participants operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a63d3675183c1a3fce84f7f85b9310ad1e009828400ec55944a424084f83f801", + "currentRequestSchemaSha256": "a63d3675183c1a3fce84f7f85b9310ad1e009828400ec55944a424084f83f801", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_organizations.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_organizations.get", + "baselineContract": { + "requestContract": "OrganizationRequest", + "method": "GET", + "pathTemplate": "/api/v1/organizations/{organizationId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "currentContract": { + "requestContract": "OrganizationRequest", + "method": "GET", + "pathTemplate": "/api/v1/organizations/{organizationId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a3f8bc675fa2d5f75f53ebf339340b95ef97db6ffa96edb85856daf21949fdb2", + "currentRequestSchemaSha256": "a3f8bc675fa2d5f75f53ebf339340b95ef97db6ffa96edb85856daf21949fdb2", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_organizations.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_organizations.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/organizations/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/organizations/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "065ad959abe31168726d802c6565ac3e588d38efcbc5a9cbf0c5d01611410089", + "currentRequestSchemaSha256": "065ad959abe31168726d802c6565ac3e588d38efcbc5a9cbf0c5d01611410089", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_organizations.tenant_lookup", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_organizations.tenant_lookup", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/tenants/lookup", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "tenant_lookup operation." + }, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/tenants/lookup", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "tenant_lookup operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_organizations.tenants", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_organizations.tenants", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/tenants", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "tenants operation." + }, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/tenants", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "tenants operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_raw.get_change", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_raw.get_change", + "baselineContract": { + "requestContract": "AllowlistedReadRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get_change operation." + }, + "currentContract": { + "requestContract": "AllowlistedReadRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get_change operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0a569045ad1e887192d1398bab406e258e92860c4d72c121e47044bba775e0e0", + "currentRequestSchemaSha256": "0a569045ad1e887192d1398bab406e258e92860c4d72c121e47044bba775e0e0", + "newRequestProperties": [], + "effect": "read", + "authority": "Fixed change GET: Change.Read, Change.Write or Change.Manager in organization, or Change.User with matching customer/requester ownership", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_raw.get_incident", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_raw.get_incident", + "baselineContract": { + "requestContract": "AllowlistedReadRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get_incident operation." + }, + "currentContract": { + "requestContract": "AllowlistedReadRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get_incident operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c025db9186f501c37744079b020c661e56ddf9af968f7b41562e8f3ae7fbaeaa", + "currentRequestSchemaSha256": "c025db9186f501c37744079b020c661e56ddf9af968f7b41562e8f3ae7fbaeaa", + "newRequestProperties": [], + "effect": "read", + "authority": "Fixed incident GET: Incident.Read, Incident.Write or Incident.Manager in organization, or Incident.User with matching customer/requester ownership", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_raw.get_request", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_raw.get_request", + "baselineContract": { + "requestContract": "AllowlistedReadRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get_request operation." + }, + "currentContract": { + "requestContract": "AllowlistedReadRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get_request operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "db51678e530cc9136b0115b19cfc735bcb7994a5de57437f808c688061a346ad", + "currentRequestSchemaSha256": "db51678e530cc9136b0115b19cfc735bcb7994a5de57437f808c688061a346ad", + "newRequestProperties": [], + "effect": "read", + "authority": "Fixed request GET: Request.Read, Request.Write or Request.Manager in organization, or Request.User with matching customer/requester ownership", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_raw.system_version", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_raw.system_version", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/system/version", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "system_version operation." + }, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/system/version", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "system_version operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Fixed GET of public backend system-version metadata; configured MCP ingress/adapter identity still applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_forms.by_service", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_forms.by_service", + "baselineContract": { + "requestContract": "RequestFormsByServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/{serviceId}/forms/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List forms for a service." + }, + "currentContract": { + "requestContract": "RequestFormsByServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/{serviceId}/forms/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List forms for a service." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "762ed0bd32f0800bcb92dd605429fcbf90d66ce684f9af30b10377e2fbe3bcba", + "currentRequestSchemaSha256": "762ed0bd32f0800bcb92dd605429fcbf90d66ce684f9af30b10377e2fbe3bcba", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_forms.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_forms.get", + "baselineContract": { + "requestContract": "RequestFormRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Get one request form." + }, + "currentContract": { + "requestContract": "RequestFormRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Get one request form." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "7b8f566f27022fbca35c2550007193595bc362e6923e4bb4a4bf014dc66ff9d4", + "currentRequestSchemaSha256": "7b8f566f27022fbca35c2550007193595bc362e6923e4bb4a4bf014dc66ff9d4", + "newRequestProperties": [], + "effect": "read", + "authority": "SelfService.User or HelpdeskAdmin; non-administrators need an audience-eligible form in Production, or an eligible linked test user, matching OrganizationId/AllowedOrganizationIds.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.bulk_complete", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.bulk_complete", + "baselineContract": { + "requestContract": "BulkRequestTaskActionRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/bulk/complete", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_complete operation." + }, + "currentContract": { + "requestContract": "BulkRequestTaskActionRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/bulk/complete", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_complete operation." + }, + "changes": { + "authority": { + "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", + "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "28f6484e23ef9e8be507cbd4cc96e6c68abcc3f389b7dcd301a2abb2e2913209", + "currentRequestSchemaSha256": "28f6484e23ef9e8be507cbd4cc96e6c68abcc3f389b7dcd301a2abb2e2913209", + "newRequestProperties": [], + "effect": "write", + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.bulk_retry", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.bulk_retry", + "baselineContract": { + "requestContract": "BulkRequestTaskActionRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/bulk/retry", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_retry operation." + }, + "currentContract": { + "requestContract": "BulkRequestTaskActionRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/bulk/retry", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_retry operation." + }, + "changes": { + "authority": { + "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", + "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1682c4eedce82cb4387fdd19de579bad4f6b6fe95a0a276c0382ad8c4483a6cd", + "currentRequestSchemaSha256": "1682c4eedce82cb4387fdd19de579bad4f6b6fe95a0a276c0382ad8c4483a6cd", + "newRequestProperties": [], + "effect": "write", + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.bulk_start", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.bulk_start", + "baselineContract": { + "requestContract": "BulkRequestTaskActionRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/bulk/start", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_start operation." + }, + "currentContract": { + "requestContract": "BulkRequestTaskActionRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/bulk/start", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_start operation." + }, + "changes": { + "authority": { + "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", + "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "3d502712af9ff22895770ab820410e0ef9ae8b18b1e1bd02a257b74c63645009", + "currentRequestSchemaSha256": "3d502712af9ff22895770ab820410e0ef9ae8b18b1e1bd02a257b74c63645009", + "newRequestProperties": [], + "effect": "write", + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.complete", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.complete", + "baselineContract": { + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/complete", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "complete operation." + }, + "currentContract": { + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/complete", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "complete operation." + }, + "changes": { + "authority": { + "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", + "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "2ea6877aeb3298ef6cb90d737e7781467e1cc6ea7d9903b9f77ff4280ffca17e", + "currentRequestSchemaSha256": "2ea6877aeb3298ef6cb90d737e7781467e1cc6ea7d9903b9f77ff4280ffca17e", + "newRequestProperties": [], + "effect": "write", + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.create", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.create", + "baselineContract": { + "requestContract": "RequestTaskCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create operation." + }, + "currentContract": { + "requestContract": "RequestTaskCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "f0b03577e2c3bd5b128c24779dd7474d456d72c9f38ca785afdbce8a6889e306", + "currentRequestSchemaSha256": "f0b03577e2c3bd5b128c24779dd7474d456d72c9f38ca785afdbce8a6889e306", + "newRequestProperties": [], + "effect": "write", + "authority": "Request.Write or Request.Manager on parent/task organization; immutable parent/customer/organization identity", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.delete", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.delete", + "baselineContract": { + "requestContract": "RequestTaskRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/request-tasks/{taskId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete operation." + }, + "currentContract": { + "requestContract": "RequestTaskRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/request-tasks/{taskId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c50e1c00dc4ebb458d3f9746da91b03bbcfee91c6c36278fcfc022727a00a910", + "currentRequestSchemaSha256": "c50e1c00dc4ebb458d3f9746da91b03bbcfee91c6c36278fcfc022727a00a910", + "newRequestProperties": [], + "effect": "write", + "authority": "Request.Write or Request.Manager on parent/task organization; immutable parent/customer/organization identity", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.fail", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.fail", + "baselineContract": { + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/fail", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "fail operation." + }, + "currentContract": { + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/fail", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "fail operation." + }, + "changes": { + "authority": { + "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", + "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "187758e56dac67c921ab4ee834d5d81b8e599015a8a7f8e81c2e2ef45c0c710b", + "currentRequestSchemaSha256": "187758e56dac67c921ab4ee834d5d81b8e599015a8a7f8e81c2e2ef45c0c710b", + "newRequestProperties": [], + "effect": "write", + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.get", + "baselineContract": { + "requestContract": "RequestTaskRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-tasks/{taskId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "currentContract": { + "requestContract": "RequestTaskRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-tasks/{taskId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "658bf990d861fe06857476b2fffe60754cd50c1d20ccb07bf7c0e6714aef6312", + "currentRequestSchemaSha256": "658bf990d861fe06857476b2fffe60754cd50c1d20ccb07bf7c0e6714aef6312", + "newRequestProperties": [], + "effect": "read", + "authority": "Request.Read, Request.Write or Request.Manager on the parent organization; owned-request permission alone does not grant task administration", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-tasks/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-tasks/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8ae912351bc8a7b4570606c70aae9af21938242e346e896646810cfee24f86d8", + "currentRequestSchemaSha256": "8ae912351bc8a7b4570606c70aae9af21938242e346e896646810cfee24f86d8", + "newRequestProperties": [], + "effect": "read", + "authority": "Request.Read, Request.Write or Request.Manager on the parent organization; owned-request permission alone does not grant task administration", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.retry", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.retry", + "baselineContract": { + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/retry", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "retry operation." + }, + "currentContract": { + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/retry", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "retry operation." + }, + "changes": { + "authority": { + "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", + "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e5c4ce75db8c161e1bebb2fdf19976ad01670d082a6fdef1e02ed06763ca2fa5", + "currentRequestSchemaSha256": "e5c4ce75db8c161e1bebb2fdf19976ad01670d082a6fdef1e02ed06763ca2fa5", + "newRequestProperties": [], + "effect": "write", + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.start", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.start", + "baselineContract": { + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/start", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "start operation." + }, + "currentContract": { + "requestContract": "RequestTaskRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/start", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "start operation." + }, + "changes": { + "authority": { + "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", + "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "909ff6d7c3beeacb8765a699283bc29fadcd660de157e7ada0b919e21479d09c", + "currentRequestSchemaSha256": "909ff6d7c3beeacb8765a699283bc29fadcd660de157e7ada0b919e21479d09c", + "newRequestProperties": [], + "effect": "write", + "authority": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_request_tasks.update", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_request_tasks.update", + "baselineContract": { + "requestContract": "RequestTaskUpdateRequest", + "method": "PATCH", + "pathTemplate": "/api/v1/request-tasks/{taskId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update operation." + }, + "currentContract": { + "requestContract": "RequestTaskUpdateRequest", + "method": "PATCH", + "pathTemplate": "/api/v1/request-tasks/{taskId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9770ee49bdee60d544a5a417eda5f8c4e54898ec128da3b40904a55a93d4ed2a", + "currentRequestSchemaSha256": "9770ee49bdee60d544a5a417eda5f8c4e54898ec128da3b40904a55a93d4ed2a", + "newRequestProperties": [], + "effect": "write", + "authority": "Request.Write or Request.Manager on parent/task organization; immutable parent/customer/organization identity", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.add_worklog", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.add_worklog", + "baselineContract": { + "requestContract": "TicketWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/{requestId}/worklogs", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "add_worklog requests." + }, + "currentContract": { + "requestContract": "TicketWorklogRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/{requestId}/worklogs", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "add_worklog requests." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "7ee1fbd727b48277fbc8622e8c6a2d9d6725e7891b639007154194eb3fb2f27f", + "currentRequestSchemaSha256": "7ee1fbd727b48277fbc8622e8c6a2d9d6725e7891b639007154194eb3fb2f27f", + "newRequestProperties": [], + "effect": "write", + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.assign", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.assign", + "baselineContract": { + "requestContract": "TicketAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign operation." + }, + "currentContract": { + "requestContract": "TicketAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4dd593094b8ec82cf0528f0c32a63679043c11178b1f54b3a983734caa36234e", + "currentRequestSchemaSha256": "4dd593094b8ec82cf0528f0c32a63679043c11178b1f54b3a983734caa36234e", + "newRequestProperties": [], + "effect": "write", + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.assign_self", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.assign_self", + "baselineContract": { + "requestContract": "ConfiguredAgentAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign_self operation." + }, + "currentContract": { + "requestContract": "ConfiguredAgentAssignmentRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/bulk/assign", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "assign_self operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1e1dc78530dc4b911ac582fb185a2a731d98e550a755b6ce1c7aa6482944f0be", + "currentRequestSchemaSha256": "1e1dc78530dc4b911ac582fb185a2a731d98e550a755b6ce1c7aa6482944f0be", + "newRequestProperties": [], + "effect": "write", + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.attachments_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.attachments_count", + "baselineContract": { + "requestContract": "RequestCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read attachments_count for one request." + }, + "currentContract": { + "requestContract": "RequestCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read attachments_count for one request." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4d2cd9f2a372eadcaa55542c3970ccdb9e8b91abc71aa70bb28719d191d5337c", + "currentRequestSchemaSha256": "4d2cd9f2a372eadcaa55542c3970ccdb9e8b91abc71aa70bb28719d191d5337c", + "newRequestProperties": [], + "effect": "read", + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.bulk_create", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.bulk_create", + "baselineContract": { + "requestContract": "RequestBulkCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_create operation." + }, + "currentContract": { + "requestContract": "RequestBulkCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_create operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "157c61ad935a37a95112b1b395012821b992f8847adafaa8c1ae1fd8b7bd82da", + "currentRequestSchemaSha256": "157c61ad935a37a95112b1b395012821b992f8847adafaa8c1ae1fd8b7bd82da", + "newRequestProperties": [], + "effect": "write", + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.bulk_state", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.bulk_state", + "baselineContract": { + "requestContract": "BulkTicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/bulk/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_state operation." + }, + "currentContract": { + "requestContract": "BulkTicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/bulk/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "bulk_state operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "2f7727f1b4c0c24fd97b4b501e984ef919436538f5b326713dea4901c12a1173", + "currentRequestSchemaSha256": "2f7727f1b4c0c24fd97b4b501e984ef919436538f5b326713dea4901c12a1173", + "newRequestProperties": [], + "effect": "write", + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.create", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.create", + "baselineContract": { + "requestContract": "RequestCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create requests." + }, + "currentContract": { + "requestContract": "RequestCreateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "create requests." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "77a601b1f4e601f187f250f1a31310d6ab9b68d6501623fa267d9bcc7859d0b5", + "currentRequestSchemaSha256": "77a601b1f4e601f187f250f1a31310d6ab9b68d6501623fa267d9bcc7859d0b5", + "newRequestProperties": [], + "effect": "write", + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.delete", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.delete", + "baselineContract": { + "requestContract": "RequestRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete requests." + }, + "currentContract": { + "requestContract": "RequestRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "delete requests." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "047289fb1c3c9765ccb136e4a8c4d86e044c3006f273dba348518e80cb83c378", + "currentRequestSchemaSha256": "047289fb1c3c9765ccb136e4a8c4d86e044c3006f273dba348518e80cb83c378", + "newRequestProperties": [], + "effect": "write", + "authority": "Request.Delete or Request.Manager within the selected organization; Request.Write alone is insufficient", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.get", + "baselineContract": { + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get requests." + }, + "currentContract": { + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get requests." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "00dac62eea5f92bf66523219748997bc955b29dbb5f212b6d3298bfeea94a5d3", + "currentRequestSchemaSha256": "00dac62eea5f92bf66523219748997bc955b29dbb5f212b6d3298bfeea94a5d3", + "newRequestProperties": [], + "effect": "read", + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a2a08783b6edc6218e45fd2436c8b325487733c0a753dd17c67ffe9a08b7d6e7", + "currentRequestSchemaSha256": "a2a08783b6edc6218e45fd2436c8b325487733c0a753dd17c67ffe9a08b7d6e7", + "newRequestProperties": [], + "effect": "read", + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.listeners_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.listeners_count", + "baselineContract": { + "requestContract": "RequestCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read listeners_count for one request." + }, + "currentContract": { + "requestContract": "RequestCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read listeners_count for one request." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0210d6ea1487ee22766ce5bdadba29b08015fd50cf5fe3132876568daa7824f0", + "currentRequestSchemaSha256": "0210d6ea1487ee22766ce5bdadba29b08015fd50cf5fe3132876568daa7824f0", + "newRequestProperties": [], + "effect": "read", + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.state", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.state", + "baselineContract": { + "requestContract": "TicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/{requestId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "state requests." + }, + "currentContract": { + "requestContract": "TicketStateRequest", + "method": "POST", + "pathTemplate": "/api/v1/requests/{requestId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "state requests." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c921fa7be851d7cdc9582350fbfa9ef122194cbfcfaf7d63babddaf733d3d25c", + "currentRequestSchemaSha256": "c921fa7be851d7cdc9582350fbfa9ef122194cbfcfaf7d63babddaf733d3d25c", + "newRequestProperties": [], + "effect": "write", + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.tasks", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.tasks", + "baselineContract": { + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/tasks", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "tasks requests." + }, + "currentContract": { + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/tasks", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "tasks requests." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "f457e59f412bfc1fa4b2d63e50bd0590e2a56193983aa20089006181b7378040", + "currentRequestSchemaSha256": "f457e59f412bfc1fa4b2d63e50bd0590e2a56193983aa20089006181b7378040", + "newRequestProperties": [], + "effect": "read", + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.timeline", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.timeline", + "baselineContract": { + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility." + }, + "currentContract": { + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8459e086d939ecebf29ef973edf89cf8c02a83212f44196e6e760b6ef93bdc0a", + "currentRequestSchemaSha256": "8459e086d939ecebf29ef973edf89cf8c02a83212f44196e6e760b6ef93bdc0a", + "newRequestProperties": [], + "effect": "read", + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.timeline_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.timeline_count", + "baselineContract": { + "requestContract": "RequestCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read timeline_count for one request." + }, + "currentContract": { + "requestContract": "RequestCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read timeline_count for one request." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d94e202dc8d4e9288166cac4194f2dcf43d940a9a2b767eb7b687ef3ab594fb0", + "currentRequestSchemaSha256": "d94e202dc8d4e9288166cac4194f2dcf43d940a9a2b767eb7b687ef3ab594fb0", + "newRequestProperties": [], + "effect": "read", + "authority": "Request read/write/manager permission or permitted owned request in organization scope", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_requests.update", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_requests.update", + "baselineContract": { + "requestContract": "RequestUpdateRequest", + "method": "PUT", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update requests." + }, + "currentContract": { + "requestContract": "RequestUpdateRequest", + "method": "PUT", + "pathTemplate": "/api/v1/requests/{requestId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "update requests." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4d91f2ff1bf302d986a3187e18d8353056b1951d5f0632aea15eaf304016501e", + "currentRequestSchemaSha256": "4d91f2ff1bf302d986a3187e18d8353056b1951d5f0632aea15eaf304016501e", + "newRequestProperties": [], + "effect": "write", + "authority": "Request management/write authority in selected organization; task lifecycle eligibility applies", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_roles.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_roles.get", + "baselineContract": { + "requestContract": "RoleRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/role-definitions/{roleId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "currentContract": { + "requestContract": "RoleRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/role-definitions/{roleId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0b0acfb3ccc96b2cf3d70fa29228362103ba693cf9a0938fd5680f0a3488b8d5", + "currentRequestSchemaSha256": "0b0acfb3ccc96b2cf3d70fa29228362103ba693cf9a0938fd5680f0a3488b8d5", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin or scoped role-management authority for ownerOrganizationId; only delegable permission intersection", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_roles.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_roles.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/role-definitions/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/role-definitions/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1b186d641c751c520d539f85c00c09eebf629b73f357dd3ec7ee8e4b0f3086a9", + "currentRequestSchemaSha256": "1b186d641c751c520d539f85c00c09eebf629b73f357dd3ec7ee8e4b0f3086a9", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin or scoped role-management authority for ownerOrganizationId; only delegable permission intersection", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_schema.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_schema.list", + "baselineContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the executable MCP operation catalog." + }, + "currentContract": { + "requestContract": "None", + "method": "LOCAL", + "pathTemplate": "local", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the executable MCP operation catalog." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Local discovery; no business API authority implied", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_search.customers", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_search.customers", + "baselineContract": { + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/global-search/customers", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "customers operation." + }, + "currentContract": { + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/global-search/customers", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "customers operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "af316570e7cab1b496dd05d4ef6a4d1eb3e4973ac66298aec5468905d8c13d75", + "currentRequestSchemaSha256": "af316570e7cab1b496dd05d4ef6a4d1eb3e4973ac66298aec5468905d8c13d75", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_search.organizations", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_search.organizations", + "baselineContract": { + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/global-search/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "organizations operation." + }, + "currentContract": { + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/global-search/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "organizations operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e98e7ffef49f503baea490a7bf3928e9711114c81f73444280c0e91aa1500e1f", + "currentRequestSchemaSha256": "e98e7ffef49f503baea490a7bf3928e9711114c81f73444280c0e91aa1500e1f", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_search.users", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_search.users", + "baselineContract": { + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/global-search/users", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "users operation." + }, + "currentContract": { + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/global-search/users", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "users operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ef572c3a5047bbd1dc78b0a872d7dc394ff23fe9c7baa10cbc9ffbeb9be4f47a", + "currentRequestSchemaSha256": "ef572c3a5047bbd1dc78b0a872d7dc394ff23fe9c7baa10cbc9ffbeb9be4f47a", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_self_service.get_request", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_self_service.get_request", + "baselineContract": { + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/requests/{requestId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get_request operation." + }, + "currentContract": { + "requestContract": "RequestRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/requests/{requestId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get_request operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0cdb3406b7f1af76fd54421125b60cd7949ab742ffacaa5219219f6ed49954b7", + "currentRequestSchemaSha256": "0cdb3406b7f1af76fd54421125b60cd7949ab742ffacaa5219219f6ed49954b7", + "newRequestProperties": [], + "effect": "read", + "authority": "SelfService.User or HelpdeskAdmin; non-administrators need an enabled linked customer and organization scope, owned request visibility and any applicable request-form audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_self_service.request_users", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_self_service.request_users", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/request-users", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "request_users operation." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/request-users", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "request_users operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ac14f0fcaeb54b7597153100a0219962fcc75587a2e228afb1b71bfe16828b8c", + "currentRequestSchemaSha256": "ac14f0fcaeb54b7597153100a0219962fcc75587a2e228afb1b71bfe16828b8c", + "newRequestProperties": [], + "effect": "read", + "authority": "SelfService.User or HelpdeskAdmin; search users/customer contacts in the caller's visible organizations. A linked customer identity is not required for this lookup.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_self_service.requests", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_self_service.requests", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/requests", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "requests operation." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/requests", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "requests operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0d90cef17d1f4d123d02376ee28818ec54691e84f1c286f4ae9d044785eca5c5", + "currentRequestSchemaSha256": "0d90cef17d1f4d123d02376ee28818ec54691e84f1c286f4ae9d044785eca5c5", + "newRequestProperties": [], + "effect": "read", + "authority": "SelfService.User or HelpdeskAdmin; non-administrators need an enabled linked customer and organization scope, owned request visibility and any applicable request-form audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_services.breadcrumb", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_services.breadcrumb", + "baselineContract": { + "requestContract": "ServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/{serviceId}/breadcrumb", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "breadcrumb operation." + }, + "currentContract": { + "requestContract": "ServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/{serviceId}/breadcrumb", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "breadcrumb operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1bb1bd83f6511de20634ff822e73bc206b8ea4ee599c9ab5bc4937d9a4096fdb", + "currentRequestSchemaSha256": "1bb1bd83f6511de20634ff822e73bc206b8ea4ee599c9ab5bc4937d9a4096fdb", + "newRequestProperties": [], + "effect": "read", + "authority": "SelfService.User or HelpdeskAdmin. Non-administrators need current tenant identity and service AllowedOrganizationIds/AllowedCustomerIds visibility; items/search_items also filter forms by release/test-user and organization audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_services.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_services.get", + "baselineContract": { + "requestContract": "ServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/{serviceId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "currentContract": { + "requestContract": "ServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/{serviceId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "39c09b1b85cf9ac261ac744a592f7b506f6f8d1bf4e6f4f0d9ef2ea1e0522c0c", + "currentRequestSchemaSha256": "39c09b1b85cf9ac261ac744a592f7b506f6f8d1bf4e6f4f0d9ef2ea1e0522c0c", + "newRequestProperties": [], + "effect": "read", + "authority": "SelfService.User or HelpdeskAdmin. Non-administrators need current tenant identity and service AllowedOrganizationIds/AllowedCustomerIds visibility; items/search_items also filter forms by release/test-user and organization audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_services.items", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_services.items", + "baselineContract": { + "requestContract": "ServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/service-items/{serviceId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "items operation." + }, + "currentContract": { + "requestContract": "ServiceRequest", + "method": "GET", + "pathTemplate": "/api/v1/service-items/{serviceId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "items operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "388cbda4d4f36d22c953826cc7699e05b8e6416ffdb61df051423cf0fbe8caa0", + "currentRequestSchemaSha256": "388cbda4d4f36d22c953826cc7699e05b8e6416ffdb61df051423cf0fbe8caa0", + "newRequestProperties": [], + "effect": "read", + "authority": "SelfService.User or HelpdeskAdmin. Non-administrators need current tenant identity and service AllowedOrganizationIds/AllowedCustomerIds visibility; items/search_items also filter forms by release/test-user and organization audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_services.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_services.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/services/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "2a6f6b59ab48b502eb0b67fbcd9e2af7e6c4d472ba89fc556c039d512eb0e3b9", + "currentRequestSchemaSha256": "2a6f6b59ab48b502eb0b67fbcd9e2af7e6c4d472ba89fc556c039d512eb0e3b9", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_services.search_items", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_services.search_items", + "baselineContract": { + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/service-items/search", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "search_items operation." + }, + "currentContract": { + "requestContract": "SearchRequest", + "method": "GET", + "pathTemplate": "/api/v1/service-items/search", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "search_items operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e91daf886523cffaa2c1329d627313dfb2b07213f9ec372e2112a54372dea93c", + "currentRequestSchemaSha256": "e91daf886523cffaa2c1329d627313dfb2b07213f9ec372e2112a54372dea93c", + "newRequestProperties": [], + "effect": "read", + "authority": "SelfService.User or HelpdeskAdmin. Non-administrators need current tenant identity and service AllowedOrganizationIds/AllowedCustomerIds visibility; items/search_items also filter forms by release/test-user and organization audience.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.breached", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/breached", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read a page of breached open tickets." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "f1cd2435cbc3c33413d8c6b0a79d0afb1c860e42c5f71630bae9e7c9790dbd14", + "newRequestProperties": [ + "page", + "pageSize", + "tenantId", + "ticketType" + ], + "effect": "read", + "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.calendars", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/sla-calendars/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read business calendars, weekly hours and date exceptions." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.completed", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/completed", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read completed ticket SLA outcomes for a declared period." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "88fc1c7d20a13d873601871b892e8b9927707a88df14f6c6fa9a246742a7936c", + "newRequestProperties": [ + "fromUtc", + "page", + "pageSize", + "tenantId", + "ticketType", + "toUtc", + "withinResolutionSla" + ], + "effect": "read", + "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.compliance", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/compliance", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read SLA compliance for a declared period and ticket type." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "61253a6b7e702b7814cc02ec19ec05838cba5baa38b3f57e557f6def2c58a9d8", + "newRequestProperties": [ + "fromUtc", + "tenantId", + "ticketType", + "toUtc" + ], + "effect": "read", + "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.create_calendar", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/sla-calendars/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a validated business-hours calendar." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "45ebe9c8389ed3220a6823b1ac13cc3d613c5d2728a882da52f8a3c5c879ecf4", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.create_policy", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/slas/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an SLA policy with its scope, matching rules, deadlines and escalations." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "49f26e21ce7d342b23cb70ea911081da84cd3fe5d155e48536e7a5ae572d459a", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.create_report_subscription", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/sla-report-subscriptions/", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an SLA report schedule with explicit recipients and tenant scope." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "aba71baa72275ecaf83635b7226d7bc5bbc33f7dd63c0bb9e33ed68c4e81235e", + "newRequestProperties": [ + "body" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.delete_calendar", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/sla-calendars/{calendarId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete a selected calendar subject to canonical usage constraints." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "57ebfd5d3cc18a603b761a4fdf618742f1a4bbd1fe97a52dd40a684ba7e184e4", + "newRequestProperties": [ + "calendarId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.delete_policy", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/slas/{policyId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete a selected SLA policy." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "b48757b90b4ecd9a96e321cfad5500b6f6597b75080a7320981a012b8af6dd10", + "newRequestProperties": [ + "policyId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.delete_report_subscription", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/sla-report-subscriptions/{subscriptionId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Remove one SLA report schedule." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "5460ea09580129457969c2e73affde13624e6e21404e80aad5f300936dbeb8af", + "newRequestProperties": [ + "subscriptionId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.near_breach", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/near-breach", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read a page of tickets approaching the selected SLA threshold." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "84a3a6909a21e7378590e22d22c7110a21bd00bd651d782b85fd4a569aef8995", + "newRequestProperties": [ + "metric", + "page", + "pageSize", + "tenantId", + "thresholdPercent", + "ticketType" + ], + "effect": "read", + "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.pause_ticket", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/sla/pause", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Pause one eligible ticket SLA with a recorded reason; parent ticket authorization is enforced." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "0d6efd0234cb6cf144ab92148772dfdd62faf01f1d7cf2548ae7cd474961e2b5", + "newRequestProperties": [ + "body", + "ticketId" + ], + "effect": "write", + "authority": "Parent ticket manager authority; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.policies", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/slas/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read SLA policies and escalation rules." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.report_subscriptions", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/sla-report-subscriptions/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read scheduled SLA reports and recipients." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.resume_ticket", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/sla/resume", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Resume one eligible ticket SLA through its canonical lifecycle." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "ab8203b1be3ebf468ef55fdd54f5e5c9fc0d679f0070bafef78f23f64da85239", + "newRequestProperties": [ + "body", + "ticketId" + ], + "effect": "write", + "authority": "Parent ticket manager authority; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.save_tenant_settings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenant-sla-settings/{tenantId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Save the selected tenant's business-hours and calendar settings." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "09c1fd777365eb0a7cec9fc4367976bb3182c3c98ea7c75b784568cccc4885c2", + "newRequestProperties": [ + "body", + "tenantId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.tenant_settings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-sla-settings/{tenantId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one tenant's business-hours and calendar selection." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "708aeaac2b35c4a7a643b142936e8ba9f1eaa167cff791cfaf05a72ef168407d", + "newRequestProperties": [ + "tenantId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.update_calendar", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/sla-calendars/{calendarId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update calendar rules and exceptions." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9958ab9b36edd137e873c7f8fbf9fc89132a1a5b4d0f662921ec4666d2f79d68", + "newRequestProperties": [ + "body", + "calendarId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.update_policy", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/slas/{policyId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update an existing SLA policy using canonical validation and audit events." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8f94da82f6adbd0472e4c6c7a2b239027e909202f330bde1a36808020a72c904", + "newRequestProperties": [ + "body", + "policyId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_sla.update_report_subscription", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/sla-report-subscriptions/{subscriptionId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Update or disable an SLA report schedule." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "3979ce851116a7e60a9b358f9c4d0c711117a08505262aa4b4bdee8c24ed3685", + "newRequestProperties": [ + "body", + "subscriptionId" + ], + "effect": "external_io", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.add_member", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Add an existing user to the selected support group with explicit membership role and source." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "cf37b6d897bd565174546b0d26640e8fd669f3302f76e23c44396b921f85f23c", + "newRequestProperties": [ + "body", + "groupId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.bootstrap_defaults", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/support/bootstrap/defaults", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Ensure the instance's default support configuration using the canonical idempotent bootstrapper." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.coverage", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/coverage/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List customer-to-provider support coverage routes." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "5e31e1d8a8367ab3bcb8d3d0be01bdf756896ef45b946a4e7c68bff4d319577c", + "newRequestProperties": [ + "customerOrganizationId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.create_coverage", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/coverage/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create explicit customer, provider and group coverage with a primary or backup role." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "99046a242760c50015e8aab89f4f5ba02a48cca054d0e25656dec4085890721d", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.create_group", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/groups/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a support group in its owning organization." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "95b8d237d00e30f37263fd9288555855745cb0a2f6bcce1fe228c5fc08e81da7", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.create_subscription", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/notification-subscriptions/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an explicit event and recipient subscription; only configured supported delivery channels are accepted." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "57d9a51cb4fc9e97fc7c6f25824bbf531314349c39dd3bf538d70ae7465deb19", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.delete_coverage", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/coverage/{coverageId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one explicitly selected support coverage route." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "85ea06e740887c83284098d7a74de4732291e18710c530bf5218c55c8fb5bf10", + "newRequestProperties": [ + "coverageId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.delete_group", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/groups/{groupId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one support group through the canonical repository rules." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "00d90fe00707a37ec073afcc1c5884b75b02bb505d9eeab6e80972c9326529f3", + "newRequestProperties": [ + "groupId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.delete_subscription", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/notification-subscriptions/{subscriptionId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one support notification subscription." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "5460ea09580129457969c2e73affde13624e6e21404e80aad5f300936dbeb8af", + "newRequestProperties": [ + "subscriptionId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.get_group", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/groups/{groupId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one support group." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "00d90fe00707a37ec073afcc1c5884b75b02bb505d9eeab6e80972c9326529f3", + "newRequestProperties": [ + "groupId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.groups", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/groups/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List support groups, optionally for one owning organization." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "d8ad96e7155f79f1c93b9334666ac05ee20f3eccde8c66166e56ec2c1f2caac7", + "newRequestProperties": [ + "owningOrganizationId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.members", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List the selected support group's members and enabled state." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "00d90fe00707a37ec073afcc1c5884b75b02bb505d9eeab6e80972c9326529f3", + "newRequestProperties": [ + "groupId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.my_preferences", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/support/notification-preferences/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authenticated caller's own support notification preferences." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "NotificationAccess for the authenticated caller; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.recipient_preview", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/organizations/{organizationId}/recipient-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Resolve the actual recipients for one organization event without sending mail." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "44a0a1f9046ba291d1c622171218f65477bb76e1ad7971eae4da36bb5064e9c7", + "newRequestProperties": [ + "eventType", + "organizationId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.remove_member", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/{memberId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Remove one membership from its verified group." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "08b9c66456b81a8b50e93b866390585f788d442a0a190e4139bed72c3ddb0675", + "newRequestProperties": [ + "groupId", + "memberId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.set_my_preference", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/notification-preferences/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update one of the authenticated caller's preferences; the server selects the caller identity." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "0f1445231f1d4e479a355468d64cdb4457bbd5878f29480dee8fa3e893d2256b", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "NotificationAccess for the authenticated caller; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.set_user_preference", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/users/{userId}/notification-preferences/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update a selected user's preference under administrator authority; the route determines the target user." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8a959143d1ac49e6651fecb2d324372736f7121b7494a9a685c2609386cdd6b2", + "newRequestProperties": [ + "body", + "userId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.subscriptions", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/notification-subscriptions/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List support notification subscriptions for one or all customer organizations." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "5e31e1d8a8367ab3bcb8d3d0be01bdf756896ef45b946a4e7c68bff4d319577c", + "newRequestProperties": [ + "customerOrganizationId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.update_coverage", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/coverage/{coverageId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update or disable a saved support coverage route." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c8aad4740b3c38079b1c59cb272543e3768921cd37312d19ad369e2228b9c067", + "newRequestProperties": [ + "body", + "coverageId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.update_group", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/groups/{groupId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update support group metadata and enabled status." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "4864c451b7b20cb70d5b160560a1623587408ae2537cd4bb63ae7a32e4bd8ad8", + "newRequestProperties": [ + "body", + "groupId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.update_member", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/{memberId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update or disable an existing membership; the API verifies that it belongs to the selected group." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "5e4a7782f34dec394de44a696a78d1ea99c64f3f84c001a1547331e2d5b42b90", + "newRequestProperties": [ + "body", + "groupId", + "memberId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.update_subscription", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/notification-subscriptions/{subscriptionId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update or disable one support notification subscription." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "6b6eed380c0f2de7bd1ef8b3cb0e62b3e29cc923480f9290af50de43cef972e3", + "newRequestProperties": [ + "body", + "subscriptionId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_support.user_preferences", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/users/{userId}/notification-preferences/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one selected user's notification preferences under administrator authority." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", + "newRequestProperties": [ + "userId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_system.version", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_system.version", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/system/version", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read safe system metadata." + }, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/system/version", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read safe system metadata." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Backend /api/v1/system/version is public metadata (AllowAnonymous); MCP ingress and the configured adapter identity still apply.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.assets", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/assets/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List asset records visible to the authorized instance administrator." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.assignments", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/{userId}/assignments", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the selected local user's role assignments within this organization." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "abf3ba1abb858db27c90cf858c482bc6c29b9fefaf1d9836646c0aefb43efc91", + "newRequestProperties": [ + "organizationId", + "userId" + ], + "effect": "read", + "authority": "Tenant role-management authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.background_worker_settings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/ops/hangfire/settings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved background-worker enablement, actual queue/storage runtime and recurring/Graph synchronization job counts." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.create_asset", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/assets/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an asset with an explicit organization identifier and bounded inventory fields. An explicit empty organizationId preserves the canonical unassigned asset behavior. The API assigns its identifier." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "fe900e5cc7e2a8a9eb6be3f18e3174123682335fb272e9ced7932f51cb4b7a0f", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.create_local_account", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a local account and return its newly issued one-time activation token as an explicitly sensitive result. This does not read an existing password. Deliver the token only through the authorized private activation workflow." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "3004a256b149a14d18f867e4bf76ffeea55fdf571a16ebde2285e0ad9c3e90d4", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.customer_dashboard", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/dashboard/customer-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the current linked customer's ticket summary. An account with no linked customer receives the canonical empty summary." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "SelfService.User; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.dashboard", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/dashboard/admin-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read live administrative incident, request and change dashboard metrics." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.delegable_roles", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/roles", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List operational built-in and tenant-owned roles that may be delegated in this organization." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", + "newRequestProperties": [ + "organizationId" + ], + "effect": "read", + "authority": "Tenant role-management authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.delete_asset", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/assets/{assetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete exactly one selected asset through the canonical administrator endpoint." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "96769b07ad76e1a25c965b905d7ad7495cc88496650a62907cd5d8cb52ed19a0", + "newRequestProperties": [ + "assetId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.delete_my_credential_record", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/integration-credentials/{credentialId}/record", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Revoke and permanently remove one of the authenticated owner's credential records through the canonical lifecycle. Read owned metadata first and preserve any required audit evidence before confirmation." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9fcfd10ec8f3ab1fee809af034a64c4ebf2f492a92c99361dc33ec32762479b6", + "newRequestProperties": [ + "credentialId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.disable_local_account", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users/{userId}/disable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Disable a local account through the existing administrator lifecycle, including session/credential invalidation." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", + "newRequestProperties": [ + "userId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.enable_local_account", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users/{userId}/enable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable a disabled local account." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", + "newRequestProperties": [ + "userId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.get_asset", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/assets/{assetId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the selected asset and its saved organization before editing." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "96769b07ad76e1a25c965b905d7ad7495cc88496650a62907cd5d8cb52ed19a0", + "newRequestProperties": [ + "assetId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.instance_branding", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/branding/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read effective instance branding, persisted values, defaults and each field's source/editability. Deployment-owned values remain authoritative." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.local_account_assignments", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/local-auth/users/{userId}/assignments", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read all scoped role assignments and local/instance-administrator flags for one account." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", + "newRequestProperties": [ + "userId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.local_account_status", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/local-auth/users/{userId}/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read a local account's enabled status." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", + "newRequestProperties": [ + "userId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.members", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List local team members and their scoped role assignments." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", + "newRequestProperties": [ + "organizationId" + ], + "effect": "read", + "authority": "Tenant user read/manage authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.my_credentials", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/integration-credentials/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List the authenticated owner's integration credential metadata, scopes, expiry and revocation state. Never returns credential secrets or another owner's records; creating additional account credentials retains its separate interactive consent boundary." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.online_users", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/presence/online-users", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read identities currently connected to the platform's presence service." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.organizations", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List the organizations the caller can administer." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "Tenant membership/settings administration or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.replace_assignments", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/{userId}/assignments", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the selected local user's delegable role assignments; an empty list removes those assignments. Other scopes and instance-admin authority remain governed by the API." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "89fd9d83ee4987924c53df577b17b0c2b4da09f1587e5380751955c224f0e80e", + "newRequestProperties": [ + "body", + "organizationId", + "userId" + ], + "effect": "write", + "authority": "Tenant role-management authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.replace_local_account_assignments", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/local-auth/users/{userId}/assignments", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the selected non-instance-admin account's explicit scoped role assignments; each role and organization is validated by the API." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "871c712c6a65ca04108df2d074699d2934ee89df2457702e3c63f0fd969e4454", + "newRequestProperties": [ + "body", + "userId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.reset_customer_login", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/local-activation-token", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Issue a new one-time activation token for the customer's single linked enabled local account. Inspect helpdesk_customers.auth_status first; external customer invite/resend/sync flows have their separate identity-provider contract." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "345ac1bf3ec630ea7bc5aa539e695cfc226f161f34b706de6ae2de99d70b7c0f", + "newRequestProperties": [ + "customerId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.reset_local_account", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users/{userId}/activation-token", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Issue a new one-time local-account activation token as an explicitly sensitive result; preserve it only through the authorized private activation workflow." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", + "newRequestProperties": [ + "userId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.revoke_my_credential", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/integration-credentials/{credentialId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Revoke one of the authenticated owner's credentials. Existing cached execution tokens are invalidated by current credential checks. A credential owned by another account remains inaccessible." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9fcfd10ec8f3ab1fee809af034a64c4ebf2f492a92c99361dc33ec32762479b6", + "newRequestProperties": [ + "credentialId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.settings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/settings/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one organization's display and contact settings." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", + "newRequestProperties": [ + "organizationId" + ], + "effect": "read", + "authority": "Tenant.Settings.Manage in organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.technician_dashboard", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/dashboard/technician-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authenticated technician's authorized open ticket counts." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskStaff; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.tenant_branding", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenants/{brandingTenantId}/branding", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved or default email branding for the canonical positive integer branding tenant identifier; organization and SLA identifiers remain separate string selectors." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "38e7516577df36987eca59266880ffaed27563bbcb6166ab8344edde34a13b01", + "newRequestProperties": [ + "brandingTenantId" + ], + "effect": "read", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.update_asset", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/assets/{assetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the selected asset's inventory fields and organization. Read current values first; supply all optional fields explicitly, using null only to clear them. The route determines the stored identifier." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "cba867c49637be359b313e157cb0522dc10a193e7afcca2f35ea70298b2c0f1b", + "newRequestProperties": [ + "assetId", + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.update_background_worker_settings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/ops/hangfire/settings", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Explicitly enable or disable background processing through the runtime administration service, which reconciles Graph dataset schedules. Inspect pending work before disabling, and verify the resulting settings and job counts." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "6d7afc647fa3a20f801e96b226c9325f586726118c6ec34db39cd0646b031f68", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.update_instance_branding", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/branding/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Save all instance branding fields after reading their current values and editability. Explicit null or blank resets an editable field to its configured default. The canonical provider preserves deployment-owned values and validates web/image URLs." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "858d4480a7a74fe490103b0ae184e44e52e5c81bc49a33678f122451d907c3d0", + "newRequestProperties": [ + "body" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.update_settings", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/settings/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update one organization's display and contact settings." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "8b58b9fa0a57631560e40e1efa1183a3c895052d230273023e724f7d208821aa", + "newRequestProperties": [ + "body", + "organizationId" + ], + "effect": "write", + "authority": "Tenant.Settings.Manage in organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tenant_admin.upload_branding_logo", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tenants/{brandingTenantId}/branding/logo", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Upload one image logo of at most 1 MiB through the canonical multipart file endpoint, then read tenant branding to verify the stored logo URL. Use the positive integer branding tenant identifier." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "14ebbcfc56445456f1e0d23cc5997f03a314445fbd6115b3464be979d1653c33", + "newRequestProperties": [ + "body", + "brandingTenantId" + ], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.attachments_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.attachments_count", + "baselineContract": { + "requestContract": "TicketCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Count attachments." + }, + "currentContract": { + "requestContract": "TicketCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/attachments/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Count attachments." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "31a1988f8ce10e9139c9f0010b6d58b97d548a0b7d7eec388633c65e2200900b", + "currentRequestSchemaSha256": "31a1988f8ce10e9139c9f0010b6d58b97d548a0b7d7eec388633c65e2200900b", + "newRequestProperties": [], + "effect": "read", + "authority": "Authenticated identity; actual ticket must pass CanViewIncident/CanViewRequest/CanViewChange: family Read, Write or Manager in its organization, or family User with matching owned customer/requester identity. Counts and mark_as_seen share this visibility check; seen-state readback is separate from notification mark_read.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.current_assignee", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/assignees/current", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Resolve an existing ticket assignment, including a retained user who is no longer eligible for a new assignment." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "1d02ea49b7aa66e095d3d1ec59a4c3e213974d15e884721b97563e518024238c", + "newRequestProperties": [ + "module", + "organizationId", + "ticketId" + ], + "effect": "read", + "authority": "Visibility of the selected ticket and matching organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.customer_options", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/customers", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enabled customer choices for one authorized organization and ticket module." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "0f30ac684e699c9c9358ce273db84230d18e4dd10068a2b4f1a23a4dd11a3044", + "newRequestProperties": [ + "module", + "organizationId" + ], + "effect": "read", + "authority": "Current module and organization authority; own-customer scope for non-managers; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.filter_options", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/filter-options", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Search authorized organization, requested-for and assignee labels for ticket filters. selectedId and customerOrgId are bounded repeated query values." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "ff6c6eb8712387b46c482f7594cb2805e0626afc60504fd0a5a9699e30b733b9", + "newRequestProperties": [ + "customerOrgId", + "dimension", + "module", + "q", + "selectedId", + "take" + ], + "effect": "read", + "authority": "Current module ticket visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.incident_activity", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/activity", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the persisted incident activity audit, independently of the rendered timeline." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "5aa90f282e330d4f89c878c47ba5549a401e6da824ca4e66e6914877bb367ea8", + "newRequestProperties": [ + "incidentId" + ], + "effect": "read", + "authority": "Parent incident visibility; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.listeners_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.listeners_count", + "baselineContract": { + "requestContract": "TicketCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Count listeners." + }, + "currentContract": { + "requestContract": "TicketCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/listeners/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Count listeners." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "b3bd6921b90d692533d0f43ead5983dad57061966eab039608a63ef2b8964ee3", + "currentRequestSchemaSha256": "b3bd6921b90d692533d0f43ead5983dad57061966eab039608a63ef2b8964ee3", + "newRequestProperties": [], + "effect": "read", + "authority": "Authenticated identity; actual ticket must pass CanViewIncident/CanViewRequest/CanViewChange: family Read, Write or Manager in its organization, or family User with matching owned customer/requester identity. Counts and mark_as_seen share this visibility check; seen-state readback is separate from notification mark_read.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.mark_as_seen", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.mark_as_seen", + "baselineContract": { + "requestContract": "TicketSeenRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/mark-as-seen", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "mark_as_seen operation." + }, + "currentContract": { + "requestContract": "TicketSeenRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/mark-as-seen", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "mark_as_seen operation." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4a5eb2c9bcd3577f4747cde66a2737f29f98423c3999f323e26ebc923d6d1bc0", + "currentRequestSchemaSha256": "4a5eb2c9bcd3577f4747cde66a2737f29f98423c3999f323e26ebc923d6d1bc0", + "newRequestProperties": [], + "effect": "write", + "authority": "Authenticated identity; actual ticket must pass CanViewIncident/CanViewRequest/CanViewChange: family Read, Write or Manager in its organization, or family User with matching owned customer/requester identity. Counts and mark_as_seen share this visibility check; seen-state readback is separate from notification mark_read.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.organization_options", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the enabled organizations available in the caller's ticket creation and editing interface." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "4024f8cd09003240dbd631a6803c065799136df882cd96874dcde8032a3b9c39", + "newRequestProperties": [ + "module" + ], + "effect": "read", + "authority": "Current ticket module permissions and enabled organizations; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.request_worklogs", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/worklogs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read authorized request worklog records and their stored effort." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c6c6bbd6134b72be550af66ed3ed037436f9da264d6d1184cc7cd78e71f57fff", + "newRequestProperties": [ + "requestId" + ], + "effect": "read", + "authority": "Parent request visibility; internal notes require staff scope; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.search_assignees", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/assignees/search", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Search bounded eligible assignees, including saved external support coverage. Use the returned eligible identity in confirmed assignment actions." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "9e7daf4caddc9c84a7650b245f0104327410883b1c4a0c58c083c239b57687ed", + "newRequestProperties": [ + "limit", + "module", + "organizationId", + "q" + ], + "effect": "read", + "authority": "Manager of the selected ticket module and organization; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.self_service_tasks", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/requests/{requestId}/tasks", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read task progress through the same owned-request and released-form audience rules as the self-service interface." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "c6c6bbd6134b72be550af66ed3ed037436f9da264d6d1184cc7cd78e71f57fff", + "newRequestProperties": [ + "requestId" + ], + "effect": "read", + "authority": "SelfService.User and current customer/form audience, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.set_customer", + "catalogStatus": "added", + "baselineOperationKey": null, + "baselineContract": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/customer", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Set a requester only on a ticket without one, using an enabled customer in the same organization. Read the ticket afterward to verify the saved requester." + }, + "changes": {}, + "requestSchemaChanged": true, + "requestSchemaChangedPointers": [ + "/" + ], + "baselineRequestSchemaSha256": null, + "currentRequestSchemaSha256": "0b6d205306b8804b8c7a2542a0f7eb9cca749e3c66dccbd4718a9ada40194509", + "newRequestProperties": [ + "body", + "ticketId", + "ticketType" + ], + "effect": "write", + "authority": "Manager of the parent ticket's organization and module; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_tickets.timeline_count", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.timeline_count", + "baselineContract": { + "requestContract": "TicketCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Count timeline entries." + }, + "currentContract": { + "requestContract": "TicketCountRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/timeline/count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Count timeline entries." + }, + "changes": { + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "84e42ec6b74cfa2b7498961794065d826723466c009eaecb6dc942c57e97a9ae", + "currentRequestSchemaSha256": "84e42ec6b74cfa2b7498961794065d826723466c009eaecb6dc942c57e97a9ae", + "newRequestProperties": [], + "effect": "read", + "authority": "Authenticated identity; actual ticket must pass CanViewIncident/CanViewRequest/CanViewChange: family Read, Write or Manager in its organization, or family User with matching owned customer/requester identity. Counts and mark_as_seen share this visibility check; seen-state readback is separate from notification mark_read.", + "boundedIntegrationCredential": { + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_users.by_email", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_users.by_email", + "baselineContract": { + "requestContract": "UserEmailRequest", + "method": "GET", + "pathTemplate": "/api/v1/users/by-email/{email}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "by_email operation." + }, + "currentContract": { + "requestContract": "UserEmailRequest", + "method": "GET", + "pathTemplate": "/api/v1/users/by-email/{email}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "by_email operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0bb0d7ee9731ce29504d8a89418f56e7a9ab13fe5e762ef116b4c7c4323d520d", + "currentRequestSchemaSha256": "0bb0d7ee9731ce29504d8a89418f56e7a9ab13fe5e762ef116b4c7c4323d520d", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_users.get", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_users.get", + "baselineContract": { + "requestContract": "UserRequest", + "method": "GET", + "pathTemplate": "/api/v1/users/{userId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "currentContract": { + "requestContract": "UserRequest", + "method": "GET", + "pathTemplate": "/api/v1/users/{userId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "get operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d1c4024d60b213ec4e2072e164eb1714a4f8a3b5d81bda60215600b40dd113d3", + "currentRequestSchemaSha256": "d1c4024d60b213ec4e2072e164eb1714a4f8a3b5d81bda60215600b40dd113d3", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + }, + { + "operationKey": "helpdesk_users.list", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_users.list", + "baselineContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/users/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "currentContract": { + "requestContract": "ListRequest", + "method": "GET", + "pathTemplate": "/api/v1/users/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "list operation." + }, + "changes": { + "credentialModes": { + "old": [ + "explicit external Authentik identity satisfying HelpdeskAdmin" + ], + "new": [ + "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", + "explicit external Authentik identity satisfying HelpdeskAdmin" + ] + }, + "ownerAdministrationCredential": { + "old": null, + "new": { + "purpose": "mcp-owner", + "grantKind": "owner-administration", + "support": "subject_to_current_owner_authority_and_domain_prerequisites", + "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." + } + }, + "sensitiveResultFields": { + "old": null, + "new": [] + } + }, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "41db0a8c8fe1dcaa9ccb792f5997ae42eac8db95a9c17637fc78923fc3914082", + "currentRequestSchemaSha256": "41db0a8c8fe1dcaa9ccb792f5997ae42eac8db95a9c17637fc78923fc3914082", + "newRequestProperties": [], + "effect": "read", + "authority": "HelpdeskAdmin (explicit administrator identity; unavailable to ordinary bounded integration credentials)", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta8_operator_evidence" + } + ] +} diff --git a/docs/contracts/mcp-operation-inventory-delta.json b/docs/contracts/mcp-operation-inventory-delta.json index beb4658e..7d4a6bb7 100644 --- a/docs/contracts/mcp-operation-inventory-delta.json +++ b/docs/contracts/mcp-operation-inventory-delta.json @@ -1,293 +1,40 @@ { "baseline": { - "sourceCommit": "a2c3b613471e5274174388070c4f844702794e28", - "file": "mcp-operation-catalog-beta7.json", - "catalogRevision": "2026-10-18.mcp-campaign-repairs-v22", - "catalogHash": "3290c0447eb033b327d9b15ea949c608bf0ae0a35c45556fda90b98abf3270bf", - "schemaHash": "cb1a42c9d8990caece7c2cff0c1e1d8e89f54d5d7bf639e7f057e7021f6406af", - "operationCount": 155, - "toolCount": 28, - "fileSha256": "66061736f4be91f0fecc50f81aaab23945a1dbf55ef230d7c17c69420a9ca7a9" + "sourceCommit": "f60369832c553b8449d12b61c8bb024172736ebe", + "file": "mcp-operation-catalog-beta10.json", + "catalogRevision": "2026-10-20.beta9-contracts-v24", + "catalogHash": "44d767508d35628a4a9c562e842834ad97053435133890646b417edd5b189f74", + "schemaHash": "fc3603d87ad56fc994cd77385474874a5bc5c9df79a7dc825f5785460463a6f7", + "operationCount": 389, + "toolCount": 37, + "fileSha256": "8d8591e35e98aab8bb913d8ccff4578bf1ed9cf1b53ede8d77d706f65cee3afe" }, "current": { + "version": "0.1.2-beta.11", "file": "mcp-operation-catalog.json", - "catalogRevision": "2026-10-19.mcp-owner-operations-v23", - "catalogHash": "f8aa2de86bf2cf46d123ba06a8bde1235ca0156758c4d1aead4febe8179ff243", - "schemaHash": "dd1d6d04490d740851d4d7e20bae92ca15ba259dec95994c8b0cda4d328d3c14", - "operationCount": 389, + "catalogRevision": "2026-10-25.beta11-contracts-v25", + "catalogHash": "8a73e9abd9a2804afe8bb12de063617e94cd25dae7ce16acf15d31082e234972", + "schemaHash": "b66e9eca38b35b255b4f98e92db50a2f08eda7675ca72a88c2aec5e64c51e16c", + "operationCount": 390, "toolCount": 37, - "fileSha256": "fcccc510321370534fd882696ebc3b5c086af396adacea7d014a9359ca64f34b" + "fileSha256": "2a14cd022a30611b779b716dc8e2d403dfb69f8311edc22030589c6c92006fe4" }, - "previousMapping": "mcp-operation-inventory-delta-beta7.json", - "addedTools": [ - "helpdesk_attachments", - "helpdesk_automation", - "helpdesk_connections", - "helpdesk_datasets", - "helpdesk_email_settings", - "helpdesk_mail", - "helpdesk_sla", - "helpdesk_support", - "helpdesk_tenant_admin" - ], + "previousMapping": "mcp-operation-inventory-delta-beta8.json", + "addedTools": [], "addedOperations": [ - "helpdesk_ai_assistant.chat", - "helpdesk_ai_assistant.chat_abandon", - "helpdesk_ai_assistant.chat_capabilities", - "helpdesk_ai_assistant.chat_history", - "helpdesk_ai_assistant.chat_new", - "helpdesk_ai_assistant.chat_open", - "helpdesk_ai_assistant.chat_reconcile", - "helpdesk_ai_assistant.chat_respond", - "helpdesk_ai_assistant.chat_send", - "helpdesk_ai_assistant.chat_stop_waiting", - "helpdesk_ai_assistant.create_webhook", - "helpdesk_ai_assistant.dispatch_investigation", - "helpdesk_ai_assistant.eligible_configurations", - "helpdesk_ai_assistant.investigation_worklog", - "helpdesk_ai_assistant.set_webhook_state", - "helpdesk_ai_assistant.update_webhook", - "helpdesk_ai_assistant.webhook_configurations", - "helpdesk_attachments.download", - "helpdesk_attachments.list", - "helpdesk_attachments.upload", - "helpdesk_auth.revoke_self", - "helpdesk_automation.approve_task", - "helpdesk_automation.approver_candidates", - "helpdesk_automation.binding_by_task", - "helpdesk_automation.binding_drift_preview", - "helpdesk_automation.binding_issues", - "helpdesk_automation.bindings", - "helpdesk_automation.callback_rejections", - "helpdesk_automation.create_binding", - "helpdesk_automation.create_form", - "helpdesk_automation.create_request_definition", - "helpdesk_automation.create_rule", - "helpdesk_automation.critical_failures", - "helpdesk_automation.delete_binding", - "helpdesk_automation.delete_rule", - "helpdesk_automation.escalated_tasks", - "helpdesk_automation.get_binding", - "helpdesk_automation.get_rule", - "helpdesk_automation.import_binding_inputs", - "helpdesk_automation.mark_binding_import_pending", - "helpdesk_automation.my_task_approval", - "helpdesk_automation.overdue_tasks", - "helpdesk_automation.pending_retries", - "helpdesk_automation.refresh_binding_drift", - "helpdesk_automation.reject_task", - "helpdesk_automation.rules", - "helpdesk_automation.sync_binding_inputs", - "helpdesk_automation.update_binding", - "helpdesk_automation.update_form", - "helpdesk_automation.update_rule", - "helpdesk_automation.workflow_metrics", - "helpdesk_automation.workflow_timeline", - "helpdesk_changes.my_approval", - "helpdesk_changes.review_approval", - "helpdesk_connections.confirm_netclaw_session_owner", - "helpdesk_connections.delete_mapping", - "helpdesk_connections.delete_pair", - "helpdesk_connections.directory", - "helpdesk_connections.generate_pairing_code", - "helpdesk_connections.incident_sources", - "helpdesk_connections.list", - "helpdesk_connections.netclaw_settings", - "helpdesk_connections.netclaw_unbound_sessions", - "helpdesk_connections.pair", - "helpdesk_connections.pair_netclaw", - "helpdesk_connections.register_incident_source", - "helpdesk_connections.save_mapping", - "helpdesk_connections.set_incident_source_credential", - "helpdesk_connections.set_incident_source_state", - "helpdesk_connections.test_mapping", - "helpdesk_connections.test_netclaw", - "helpdesk_connections.test_netclaw_draft", - "helpdesk_connections.update_netclaw_settings", - "helpdesk_datasets.create", - "helpdesk_datasets.create_credential", - "helpdesk_datasets.credentials", - "helpdesk_datasets.delete", - "helpdesk_datasets.get", - "helpdesk_datasets.graph_settings", - "helpdesk_datasets.list", - "helpdesk_datasets.options", - "helpdesk_datasets.revoke_credential", - "helpdesk_datasets.rows", - "helpdesk_datasets.save_graph_settings", - "helpdesk_datasets.sync_graph", - "helpdesk_datasets.update", - "helpdesk_datasets.upsert_rows", - "helpdesk_email_settings.archive", - "helpdesk_email_settings.create", - "helpdesk_email_settings.create_layout", - "helpdesk_email_settings.create_rule", - "helpdesk_email_settings.create_template", - "helpdesk_email_settings.delete_layout", - "helpdesk_email_settings.delete_template", - "helpdesk_email_settings.diagnostics", - "helpdesk_email_settings.disable", - "helpdesk_email_settings.disable_rule", - "helpdesk_email_settings.effective", - "helpdesk_email_settings.enable", - "helpdesk_email_settings.enable_rule", - "helpdesk_email_settings.get", - "helpdesk_email_settings.get_rule", - "helpdesk_email_settings.historical_import", - "helpdesk_email_settings.historical_preview", - "helpdesk_email_settings.layout_choices", - "helpdesk_email_settings.layouts", - "helpdesk_email_settings.list", - "helpdesk_email_settings.outgoing", - "helpdesk_email_settings.preview_template", - "helpdesk_email_settings.reorder_rules", - "helpdesk_email_settings.retry_receipt", - "helpdesk_email_settings.rule_audit", - "helpdesk_email_settings.rules", - "helpdesk_email_settings.save_outgoing", - "helpdesk_email_settings.send_test", - "helpdesk_email_settings.set_worker", - "helpdesk_email_settings.sync", - "helpdesk_email_settings.templates", - "helpdesk_email_settings.test_draft_mailbox", - "helpdesk_email_settings.test_mailbox", - "helpdesk_email_settings.test_outgoing", - "helpdesk_email_settings.update", - "helpdesk_email_settings.update_layout", - "helpdesk_email_settings.update_rule", - "helpdesk_email_settings.update_template", - "helpdesk_email_settings.upload_template_image", - "helpdesk_email_settings.worker_status", - "helpdesk_incidents.bulk_delete", - "helpdesk_incidents.bulk_marketing_spam", - "helpdesk_incidents.create_relation", - "helpdesk_incidents.delete_relation", - "helpdesk_incidents.relations", - "helpdesk_mail.changed_route_preview", - "helpdesk_mail.failed", - "helpdesk_mail.outgoing_retry_preview", - "helpdesk_mail.pending", - "helpdesk_mail.pending_actions", - "helpdesk_mail.pending_count", - "helpdesk_mail.pending_organizations", - "helpdesk_mail.retry", - "helpdesk_mail.retry_confirmed_undelivered", - "helpdesk_mail.retry_current_outgoing", - "helpdesk_mail.retry_current_route", - "helpdesk_mail.send", - "helpdesk_mail.test_provider", - "helpdesk_mail.uncertain_retry_preview", - "helpdesk_notifications.error_summary", - "helpdesk_notifications.timeline", - "helpdesk_notifications.unread", - "helpdesk_sla.breached", - "helpdesk_sla.calendars", - "helpdesk_sla.completed", - "helpdesk_sla.compliance", - "helpdesk_sla.create_calendar", - "helpdesk_sla.create_policy", - "helpdesk_sla.create_report_subscription", - "helpdesk_sla.delete_calendar", - "helpdesk_sla.delete_policy", - "helpdesk_sla.delete_report_subscription", - "helpdesk_sla.near_breach", - "helpdesk_sla.pause_ticket", - "helpdesk_sla.policies", - "helpdesk_sla.report_subscriptions", - "helpdesk_sla.resume_ticket", - "helpdesk_sla.save_tenant_settings", - "helpdesk_sla.tenant_settings", - "helpdesk_sla.update_calendar", - "helpdesk_sla.update_policy", - "helpdesk_sla.update_report_subscription", - "helpdesk_support.add_member", - "helpdesk_support.bootstrap_defaults", - "helpdesk_support.coverage", - "helpdesk_support.create_coverage", - "helpdesk_support.create_group", - "helpdesk_support.create_subscription", - "helpdesk_support.delete_coverage", - "helpdesk_support.delete_group", - "helpdesk_support.delete_subscription", - "helpdesk_support.get_group", - "helpdesk_support.groups", - "helpdesk_support.members", - "helpdesk_support.my_preferences", - "helpdesk_support.recipient_preview", - "helpdesk_support.remove_member", - "helpdesk_support.set_my_preference", - "helpdesk_support.set_user_preference", - "helpdesk_support.subscriptions", - "helpdesk_support.update_coverage", - "helpdesk_support.update_group", - "helpdesk_support.update_member", - "helpdesk_support.update_subscription", - "helpdesk_support.user_preferences", - "helpdesk_tenant_admin.assets", - "helpdesk_tenant_admin.assignments", - "helpdesk_tenant_admin.background_worker_settings", - "helpdesk_tenant_admin.create_asset", - "helpdesk_tenant_admin.create_local_account", - "helpdesk_tenant_admin.customer_dashboard", - "helpdesk_tenant_admin.dashboard", - "helpdesk_tenant_admin.delegable_roles", - "helpdesk_tenant_admin.delete_asset", - "helpdesk_tenant_admin.delete_my_credential_record", - "helpdesk_tenant_admin.disable_local_account", - "helpdesk_tenant_admin.enable_local_account", - "helpdesk_tenant_admin.get_asset", - "helpdesk_tenant_admin.instance_branding", - "helpdesk_tenant_admin.local_account_assignments", - "helpdesk_tenant_admin.local_account_status", - "helpdesk_tenant_admin.members", - "helpdesk_tenant_admin.my_credentials", - "helpdesk_tenant_admin.online_users", - "helpdesk_tenant_admin.organizations", - "helpdesk_tenant_admin.replace_assignments", - "helpdesk_tenant_admin.replace_local_account_assignments", - "helpdesk_tenant_admin.reset_customer_login", - "helpdesk_tenant_admin.reset_local_account", - "helpdesk_tenant_admin.revoke_my_credential", - "helpdesk_tenant_admin.settings", - "helpdesk_tenant_admin.technician_dashboard", - "helpdesk_tenant_admin.tenant_branding", - "helpdesk_tenant_admin.update_asset", - "helpdesk_tenant_admin.update_background_worker_settings", - "helpdesk_tenant_admin.update_instance_branding", - "helpdesk_tenant_admin.update_settings", - "helpdesk_tenant_admin.upload_branding_logo", - "helpdesk_tickets.current_assignee", - "helpdesk_tickets.customer_options", - "helpdesk_tickets.filter_options", - "helpdesk_tickets.incident_activity", - "helpdesk_tickets.organization_options", - "helpdesk_tickets.request_worklogs", - "helpdesk_tickets.search_assignees", - "helpdesk_tickets.self_service_tasks", - "helpdesk_tickets.set_customer" + "helpdesk_email_settings.delete_rule" ], "removedOperations": [], - "retainedOperationCount": 155, - "changedRetainedOperationCount": 155, + "retainedOperationCount": 389, + "changedRetainedOperationCount": 0, "intentionalChanges": [ - "Add explicitly consented owner-administration HTTP MCP grants with current owner administrator, credential, organization and revocation checks; ordinary scoped credentials retain their ceiling.", - "Retain exact external AI authority and add an explicitly revalidated owner MCP alternative for logs.search and bound ai_assistant.report; invocation/event/ticket/correlation checks remain authoritative.", - "Add typed fixed-route operator adapters for automation forms, rules, bindings, provider targets, mail/settings/templates, support, SLA, datasets, attachments, connections and instance/tenant administration.", - "Expose local-account and linked-local-customer activation separately from the retained external identity-provider customer invitation operations.", - "Preserve the authenticated owner's credential metadata, revoke and record deletion capability while retaining interactive consent for issuance; ordinary and owner agents can revoke their current source credential.", - "Add actor-bound request-task and change approval decisions with shared signed/authenticated transactional serialization, durable effects and recoverable postcommit workflow continuation.", - "Add AI webhook configuration, bound investigation dispatch/worklogs and native chat interaction/recovery; first-use GET chat_open is declared mutating and requires confirmation.", - "Bind AI dispatch idempotency to its organization, ticket, configuration, actor and instruction before outbound effects; incompatible key reuse returns conflict.", - "Add typed Netclaw pair-and-save, unsaved-settings testing and exact reviewed legacy-session owner assignment with revision checks.", - "Add authenticated dataset row writes sharing the canonical ingestion/Graph database fence; case-insensitive keys, explicit complete replacement and concurrency conflicts are disclosed.", - "Require explicit sensitive configuration writes; redact submitted and stored secrets throughout envelopes and previews; allow only operation-specific newly minted one-time fields on successful sensitive results; HTTP MCP responses are no-store.", - "Add incident relationship list/create/delete and confirmed silent bulk deletion/marketing-spam operations; ticket requester/assignee choices, dashboard and notification timeline APIs are callable.", - "Make JSON schemas executable for nullable replacement fields, defined enum values, exact integral JSON lexemes, bounded collections/content, dates/durations, image multipart transport, query choices and per-item limits." + "Add confirmed helpdesk_email_settings.delete_rule through the fixed DELETE /api/v1/inbound-email-rules/{ruleId} administrator endpoint, preserving delivery and rule audit history.", + "Retain all 389 beta.10 operation contracts, request schemas, authorities, confirmation requirements and transport dispositions unchanged." ], "campaignEvidence": { - "scope": "This file maps source contracts only. It carries no production pass result and does not relabel historical beta.7 blocked/failed rows.", - "requirement": "Every current operation needs its own fresh positive business evidence; required negative authority, isolation, confirmation, recovery and domain cases remain additional campaign gates.", - "historicalSource": "Original beta.7 catalog and inventory mapping are retained byte-for-byte; supplied prior campaign evidence remains separate.", + "scope": "This file maps source contracts only and carries no deployed production acceptance result. The beta.10 NOT_READY receipt remains historical.", + "requirement": "All 390 current operations require fresh beta.11 evidence, including the new confirmed rule deletion with independent absence/audit readback and ordinary-authority denial. Domain cases, historical obligations, cleanup and post-functional soak remain separate gates.", + "historicalSource": "The exact beta.10 catalog and prior beta.7-to-beta.8 delta are retained byte-for-byte from the beta.10 release commit.", "schemaDigestEncoding": "Per-operation request schema SHA-256 uses UTF-8 JSON with sorted object keys and compact separators; catalog/schema hashes are the exported runtime values." }, "operations": [ @@ -313,30 +60,7 @@ "confirmationRequired": true, "description": "create_category operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "08886105b8fb58ef7d6188d16de1a26ac906545e9f752c8155fee5d2ea3a903b", @@ -348,7 +72,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.create_customer", @@ -372,30 +96,7 @@ "confirmationRequired": true, "description": "create_customer operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "8a2cc60d0a94d142f3b115b99da497e76aecb82e82693633834875afd6d89df0", @@ -407,7 +108,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.create_organization", @@ -431,30 +132,7 @@ "confirmationRequired": true, "description": "create_organization operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "f1680e29ab0ce0e9d4eb7efb981f378861914d3f2d662736546c6374cee9ff40", @@ -466,7 +144,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.create_request_form", @@ -490,30 +168,7 @@ "confirmationRequired": true, "description": "create_request_form operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "31ce93f6a1d690552ef49d1b2ba1cf5c211e8fa509589fd46277b62c1f67cbc7", @@ -525,7 +180,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.create_role", @@ -549,21 +204,7 @@ "confirmationRequired": true, "description": "create_role operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "7da310104da15f1030a060859bd8da158612d6314ce862aea28596f7c00fde7b", @@ -575,7 +216,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.create_self_service_request", @@ -599,21 +240,7 @@ "confirmationRequired": true, "description": "create_self_service_request operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "c2500ce8c29a2a75733a50f4a82706130c1eb37aebe20fa4bd87945b663a890f", @@ -625,7 +252,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.create_service", @@ -649,30 +276,7 @@ "confirmationRequired": true, "description": "create_service operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "6c54f2121e74d613d3e0769590d6493356f3a4b20f3cad863166cd7eb9893d02", @@ -684,7 +288,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.create_service_request_form", @@ -708,30 +312,7 @@ "confirmationRequired": true, "description": "create_service_request_form operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "cf7b399f1236279ca696f5b4706b566d809f0f1c64ad6be2a63fd0e9ad0f974c", @@ -743,7 +324,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.create_user", @@ -767,30 +348,7 @@ "confirmationRequired": true, "description": "create_user operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "fc5d762c6344c5a4b8f0c69732a09d429c865e9d66b05b587798f2aa0a5289f4", @@ -802,7 +360,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.customer_disable_login", @@ -815,7 +373,7 @@ "effect": "write", "readOnly": false, "confirmationRequired": true, - "description": "customer_disable_login operation." + "description": "customer_disable_login manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." }, "currentContract": { "requestContract": "AdministrativeMutationRequest", @@ -826,44 +384,7 @@ "confirmationRequired": true, "description": "customer_disable_login manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "description": { - "old": "customer_disable_login operation.", - "new": "customer_disable_login manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "prerequisites": { - "old": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Disposable existing customer and HelpdeskAdmin; configured supported authentication mode/provider. Invitations require isolated delivery capture for acceptance; Local/ambiguous identity and unavailable-provider results are distinct." - ], - "new": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." - ] - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "a3e2f61b3a9e5396c7b3065834e0b032e2876925f0e1f788b650484d95a3a743", @@ -875,7 +396,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.customer_invite", @@ -888,7 +409,7 @@ "effect": "write", "readOnly": false, "confirmationRequired": true, - "description": "customer_invite operation." + "description": "customer_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." }, "currentContract": { "requestContract": "AdministrativeMutationRequest", @@ -899,44 +420,7 @@ "confirmationRequired": true, "description": "customer_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "description": { - "old": "customer_invite operation.", - "new": "customer_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "prerequisites": { - "old": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Disposable existing customer and HelpdeskAdmin; configured supported authentication mode/provider. Invitations require isolated delivery capture for acceptance; Local/ambiguous identity and unavailable-provider results are distinct." - ], - "new": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." - ] - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "2490d28e150c64123c476734d2566715f3f78ea921a51e391a06c7b1bdbd928a", @@ -948,7 +432,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.customer_resend_invite", @@ -961,7 +445,7 @@ "effect": "write", "readOnly": false, "confirmationRequired": true, - "description": "customer_resend_invite operation." + "description": "customer_resend_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." }, "currentContract": { "requestContract": "AdministrativeMutationRequest", @@ -972,44 +456,7 @@ "confirmationRequired": true, "description": "customer_resend_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "description": { - "old": "customer_resend_invite operation.", - "new": "customer_resend_invite manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "prerequisites": { - "old": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Disposable existing customer and HelpdeskAdmin; configured supported authentication mode/provider. Invitations require isolated delivery capture for acceptance; Local/ambiguous identity and unavailable-provider results are distinct." - ], - "new": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." - ] - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "6c2999659a07f022ecf045efff8801e3560a87fbd8549280946977fa0d6f5177", @@ -1021,7 +468,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.customer_sync_authentik", @@ -1034,7 +481,7 @@ "effect": "write", "readOnly": false, "confirmationRequired": true, - "description": "customer_sync_authentik operation." + "description": "customer_sync_authentik manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." }, "currentContract": { "requestContract": "AdministrativeMutationRequest", @@ -1045,44 +492,7 @@ "confirmationRequired": true, "description": "customer_sync_authentik manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "description": { - "old": "customer_sync_authentik operation.", - "new": "customer_sync_authentik manages an External identity-provider customer login and requires configured Authentik. Inspect helpdesk_customers.auth_status first. Local activation uses helpdesk_tenant_admin.reset_customer_login; local disable/enable uses the linked local-account userId with disable_local_account/enable_local_account. Identity-mode mismatch is a real 409 prerequisite result." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "prerequisites": { - "old": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Disposable existing customer and HelpdeskAdmin; configured supported authentication mode/provider. Invitations require isolated delivery capture for acceptance; Local/ambiguous identity and unavailable-provider results are distinct." - ], - "new": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Existing enabled customer with an External identity-provider login and configured Authentik; inspect helpdesk_customers.auth_status first. Local accounts use helpdesk_tenant_admin.reset_customer_login for a new activation token and disable_local_account/enable_local_account with the linked userId. Identity-mode mismatch remains a real 409 prerequisite result; a provider denial is not an accomplished lifecycle effect." - ] - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "55bdcb33b4c4f958b0e8a295afbbfaf106160f3efc4d23791a52a1c4295ff604", @@ -1094,7 +504,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.delete_category", @@ -1118,30 +528,7 @@ "confirmationRequired": true, "description": "delete_category operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "9c26f259c6e85ed190dd2ccb855b819601e7bd6fd6415e8f918bbdaabf2b7eef", @@ -1153,7 +540,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.delete_customer", @@ -1177,30 +564,7 @@ "confirmationRequired": true, "description": "delete_customer operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "9437bc3f9a84285b4cc7c650904d32aa1a6cab5a138efd970e90c5f230f57040", @@ -1212,7 +576,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.delete_organization", @@ -1236,30 +600,7 @@ "confirmationRequired": true, "description": "delete_organization operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "e6c7c3aecc11ce55e82ad41cf21533113a5d0f06bb3219aa777313b363518a10", @@ -1271,7 +612,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.delete_request_form", @@ -1295,30 +636,7 @@ "confirmationRequired": true, "description": "delete_request_form operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "d3564e06f833aa91e92f9cf054befd4375ebd6274cf5cdbbaedd48600804718f", @@ -1330,7 +648,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.delete_role", @@ -1354,21 +672,7 @@ "confirmationRequired": true, "description": "delete_role operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "3ea6559a074b9ff3338751c81e11c59328fdf7bb7ff60c502271ffe06a56835a", @@ -1380,7 +684,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.delete_service", @@ -1404,30 +708,7 @@ "confirmationRequired": true, "description": "delete_service operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "b5221c53e28c71730a8805eacc82551712901531e6e790a2d5ce8aab021c3903", @@ -1439,7 +720,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.delete_user", @@ -1463,30 +744,7 @@ "confirmationRequired": true, "description": "delete_user operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "9751842a27a95a486e7b6a2ec02534170db8d2199a308cb6c0845676d122d81e", @@ -1498,7 +756,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.provision_user", @@ -1522,21 +780,7 @@ "confirmationRequired": true, "description": "provision_user operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -1548,7 +792,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.update_category", @@ -1572,30 +816,7 @@ "confirmationRequired": true, "description": "update_category operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "79a2803198699074f576da1647fc12314d9ce291b858a2717b916668bf9b06b0", @@ -1607,7 +828,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.update_customer", @@ -1631,30 +852,7 @@ "confirmationRequired": true, "description": "update_customer operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "aeb0f5cd2d2c3d4ac2535aca06d535c22e216e7c24cb5a55dac57ba9581a8e88", @@ -1666,7 +864,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.update_organization", @@ -1690,30 +888,7 @@ "confirmationRequired": true, "description": "update_organization operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "1d57dd3c377bf2d73c16d42cd97ba31275c6dd8872fdf06e04ecd7025ed90380", @@ -1725,7 +900,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.update_organization_branding", @@ -1749,30 +924,7 @@ "confirmationRequired": true, "description": "update_organization_branding operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "3ebb4f3e69070edee5db1e185d0e18964930ab1f95e1be4249d8db8fd6e17379", @@ -1784,7 +936,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.update_request_form", @@ -1808,35 +960,10 @@ "confirmationRequired": true, "description": "update_request_form operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/properties/allowedOrganizationIds/type" - ], - "baselineRequestSchemaSha256": "33743ec592053a986515b3da4ee2187da9facbe9075568d9840120d26de6b9f5", + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4e5dbdd286145f1e1b15b9c144210c17d0fd3baf3a5a10d9b3cd6a320a3248cc", "currentRequestSchemaSha256": "4e5dbdd286145f1e1b15b9c144210c17d0fd3baf3a5a10d9b3cd6a320a3248cc", "newRequestProperties": [], "effect": "write", @@ -1845,7 +972,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.update_role", @@ -1869,21 +996,7 @@ "confirmationRequired": true, "description": "update_role operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "8af5055ac40b8186cb77374f845479aaf58b3201a1cfda9dbbad3134ad186c14", @@ -1895,7 +1008,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.update_service", @@ -1919,30 +1032,7 @@ "confirmationRequired": true, "description": "update_service operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "dfd9a8020826219023c100639e7eee2d36b318a6c7021326a19bad2866fd4023", @@ -1954,7 +1044,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_admin_mutations.update_user", @@ -1978,30 +1068,7 @@ "confirmationRequired": true, "description": "update_user operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "84d62911f3747bdcdfc771b938b6a3b97551bd0029fb09867ee40f29c8f33d65", @@ -2013,13 +1080,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.chat", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.chat", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read at most 200 durable events after cursor from an explicit existing conversation without creating one. Use its returned lastSequence and event sequence values to read remaining pages." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2030,31 +1105,32 @@ "description": "Read at most 200 durable events after cursor from an explicit existing conversation without creating one. Use its returned lastSequence and event sequence values to read remaining pages." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4908dec419a5b92a250faf12d754f092405ed702ff0965d62501c78bfc1cf1d8", "currentRequestSchemaSha256": "4908dec419a5b92a250faf12d754f092405ed702ff0965d62501c78bfc1cf1d8", - "newRequestProperties": [ - "conversationId", - "cursor", - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "read", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.chat_abandon", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.chat_abandon", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/abandon", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Abandon unresolved delivery using stable resolutionId and expectedMessageId with explicit acknowledgement that the previous remote turn may still execute. The canonical API audits and serializes this resolution." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2065,30 +1141,32 @@ "description": "Abandon unresolved delivery using stable resolutionId and expectedMessageId with explicit acknowledgement that the previous remote turn may still execute. The canonical API audits and serializes this resolution." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "6e57682f8c58e09e81bbd6a7595f69fe4e882bf7bfd018340ae78d84f6c795cf", "currentRequestSchemaSha256": "6e57682f8c58e09e81bbd6a7595f69fe4e882bf7bfd018340ae78d84f6c795cf", - "newRequestProperties": [ - "body", - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "write", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.chat_capabilities", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.chat_capabilities", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat-capabilities", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read native chat availability and its actual disabled reason. SQLite or deployment-disabled native chat is an unavailable capability, not a successful chat campaign." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2099,29 +1177,32 @@ "description": "Read native chat availability and its actual disabled reason. SQLite or deployment-disabled native chat is an unavailable capability, not a successful chat campaign." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", "currentRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", - "newRequestProperties": [ - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "read", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.chat_history", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.chat_history", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/history", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List up to 50 native conversations for this ticket, active first, with skip for older pages. Provider credentials and session paths are excluded." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2132,30 +1213,32 @@ "description": "List up to 50 native conversations for this ticket, active first, with skip for older pages. Provider credentials and session paths are excluded." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "37773abfcc1a1210f6f0c77f1e121c0ab18684c646dfecc1fd48b671aa7a0984", "currentRequestSchemaSha256": "37773abfcc1a1210f6f0c77f1e121c0ab18684c646dfecc1fd48b671aa7a0984", - "newRequestProperties": [ - "skip", - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "read", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.chat_new", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.chat_new", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/new", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Archive the selected idle conversation and open a blank one. Active or unresolved turns must first complete or use the explicit recovery/abandon lifecycle." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2166,30 +1249,32 @@ "description": "Archive the selected idle conversation and open a blank one. Active or unresolved turns must first complete or use the explicit recovery/abandon lifecycle." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "fb7b1d8500fa90bb7e7959fb6dc16dbf10ddeacbe86a7bd35c08dfcb0d731a37", "currentRequestSchemaSha256": "fb7b1d8500fa90bb7e7959fb6dc16dbf10ddeacbe86a7bd35c08dfcb0d731a37", - "newRequestProperties": [ - "body", - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "write", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.chat_open", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.chat_open", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Open the current native conversation, creating the first one when absent. This canonical GET can persist a conversation, so the MCP operation requires explicit confirmation. Read chat_capabilities first." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2200,29 +1285,32 @@ "description": "Open the current native conversation, creating the first one when absent. This canonical GET can persist a conversation, so the MCP operation requires explicit confirmation. Read chat_capabilities first." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", "currentRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", - "newRequestProperties": [ - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "write", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.chat_reconcile", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.chat_reconcile", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/reconcile", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Request conservative recovery of an unresolved native turn using the saved provider session. This never resends the operator message." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2233,30 +1321,32 @@ "description": "Request conservative recovery of an unresolved native turn using the saved provider session. This never resends the operator message." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "fb7b1d8500fa90bb7e7959fb6dc16dbf10ddeacbe86a7bd35c08dfcb0d731a37", "currentRequestSchemaSha256": "fb7b1d8500fa90bb7e7959fb6dc16dbf10ddeacbe86a7bd35c08dfcb0d731a37", - "newRequestProperties": [ - "body", - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.chat_respond", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.chat_respond", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/interactions/{callId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Select one exact offered option for the current interaction. Conversation, call ID, option and current awaiting-approval state remain enforced by the canonical API." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2267,31 +1357,32 @@ "description": "Select one exact offered option for the current interaction. Conversation, call ID, option and current awaiting-approval state remain enforced by the canonical API." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0eeb40eaeb9c1d5606f4709f2ea107ad903c8c96c06866066d5c2ab3ce0bcc41", "currentRequestSchemaSha256": "0eeb40eaeb9c1d5606f4709f2ea107ad903c8c96c06866066d5c2ab3ce0bcc41", - "newRequestProperties": [ - "body", - "callId", - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.chat_send", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.chat_send", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/messages", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Submit one native chat message with a stable clientMessageId. Retry only the exact same text and identity; if delivery is uncertain, inspect chat and use chat_reconcile without resending." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2302,30 +1393,32 @@ "description": "Submit one native chat message with a stable clientMessageId. Retry only the exact same text and identity; if delivery is uncertain, inspect chat and use chat_reconcile without resending." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "49ebeb7437c02dbafd22c91f4c198a650486ae7d82fb2991276b631569e24215", "currentRequestSchemaSha256": "49ebeb7437c02dbafd22c91f4c198a650486ae7d82fb2991276b631569e24215", - "newRequestProperties": [ - "body", - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.chat_stop_waiting", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.chat_stop_waiting", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/chat/stop-waiting", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Stop waiting for the explicitly identified uncertain turn and retire its local transport owner. This records uncertainty and never claims remote cancellation or resends the message." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2336,30 +1429,32 @@ "description": "Stop waiting for the explicitly identified uncertain turn and retire its local transport owner. This records uncertainty and never claims remote cancellation or resends the message." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a93a9272b7ee9d137f0bb147075de6a53dd6613a0b5113a39db64c230cbc3cba", "currentRequestSchemaSha256": "a93a9272b7ee9d137f0bb147075de6a53dd6613a0b5113a39db64c230cbc3cba", - "newRequestProperties": [ - "body", - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; native chat requires an enabled PostgreSQL deployment and exact ticket/conversation binding; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.create_webhook", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.create_webhook", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an organization-bound AI assistance webhook with numeric ticket areas (0 incidents, 1 requests, 2 changes). The API validates the configured endpoint; no investigation is dispatched by saving settings." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2370,28 +1465,32 @@ "description": "Create an organization-bound AI assistance webhook with numeric ticket areas (0 incidents, 1 requests, 2 changes). The API validates the configured endpoint; no investigation is dispatched by saving settings." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "07b2ffc2fa959a37b86f23ddc0567c9484f60672e8dd83e808c0f46c748f0296", "currentRequestSchemaSha256": "07b2ffc2fa959a37b86f23ddc0567c9484f60672e8dd83e808c0f46c748f0296", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.dispatch_investigation", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.dispatch_investigation", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/investigations", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Dispatch one AI investigation using a saved eligible configuration and an explicit operator assistance request. Keep the same idempotencyKey for retries of this exact ticket, configuration and request; read investigation_worklog before retrying an uncertain result." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2402,30 +1501,32 @@ "description": "Dispatch one AI investigation using a saved eligible configuration and an explicit operator assistance request. Keep the same idempotencyKey for retries of this exact ticket, configuration and request; read investigation_worklog before retrying an uncertain result." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0ff14dba07d4da022d0cffe13081ca223977dc0a90d4cd8ce350172e9233bc68", "currentRequestSchemaSha256": "0ff14dba07d4da022d0cffe13081ca223977dc0a90d4cd8ce350172e9233bc68", - "newRequestProperties": [ - "body", - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.eligible_configurations", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.eligible_configurations", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/eligible-configurations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List active AI webhook configurations eligible for this incident, request or change and its actual organization." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2436,29 +1537,32 @@ "description": "List active AI webhook configurations eligible for this incident, request or change and its actual organization." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", "currentRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", - "newRequestProperties": [ - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "read", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.investigation_worklog", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.investigation_worklog", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/ai-assistant/worklog", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read persisted investigation identities, correlation IDs, progress and outcomes for this ticket. This snapshot provides the worklog evidence also shown by the UI stream." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2469,23 +1573,18 @@ "description": "Read persisted investigation identities, correlation IDs, progress and outcomes for this ticket. This snapshot provides the worklog evidence also shown by the UI stream." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", "currentRequestSchemaSha256": "9ce5cc4317a07c2d6822ef746f05552bf84f175bf690c8e3b002d6b424061b2f", - "newRequestProperties": [ - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "read", "authority": "Current Incident, Request or Change management authority in the actual ticket organization, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.report", @@ -2509,54 +1608,7 @@ "confirmationRequired": false, "description": "report operation." }, - "changes": { - "authority": { - "old": "Exact AuthentikAiAgent authentication scheme plus authenticated AI invocation reporting authority; matched invocation, ticket, event and correlation binding", - "new": "Exact AuthentikAiAgent scheme or explicit current administrator mcp-owner grant plus authenticated AI invocation reporting authority; matched invocation, ticket, event and correlation binding" - }, - "boundedIntegrationCredential": { - "old": { - "support": "denied_by_policy", - "reason": "The exact AuthentikAiAgent API authentication scheme is required. Ordinary integration credentials and gateway execution tokens cannot satisfy it, regardless of scoped grants. Explicit external Authentik downstream identity is supported; never switch modes as fallback." - }, - "new": { - "support": "denied_by_policy", - "reason": "Ordinary scoped credentials cannot satisfy agent-operation authority. An explicitly approved mcp-owner grant or the exact external AuthentikAiAgent scheme is required; invocation and ticket binding remain authoritative." - } - }, - "credentialModes": { - "old": [ - "explicit external Authentik downstream identity satisfying exact AuthentikAiAgent scheme" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik downstream identity satisfying exact AuthentikAiAgent scheme" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "prerequisites": { - "old": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Real authenticated existing invocation/organization/event/ticket/correlation binding under the exact AI scheme, including token lifetime validation. Report appends AI worklog autonomously; a matching duplicate retains its stored event, while conflicting event-ID reuse and new callbacks after Completed, Failed or Cancelled are rejected." - ], - "new": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Real authenticated existing invocation/organization/event/ticket/correlation binding under an explicitly approved owner grant or exact AI scheme, including token lifetime validation. Report appends AI worklog autonomously; a matching duplicate retains its stored event, while conflicting event-ID reuse and new callbacks after Completed, Failed or Cancelled are rejected." - ] - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "d9de2720203d1639e64becad99ff8e922cd8d66ab23b317ff5df2e1ed9dee4b7", @@ -2568,13 +1620,21 @@ "support": "denied_by_policy", "reason": "Ordinary scoped credentials cannot satisfy agent-operation authority. An explicitly approved mcp-owner grant or the exact external AuthentikAiAgent scheme is required; invocation and ticket binding remain authoritative." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.set_webhook_state", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.set_webhook_state", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/{webhookId}/state", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable, disable, archive or restore an organization-bound AI webhook configuration with an attributed administrative audit." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2585,29 +1645,32 @@ "description": "Enable, disable, archive or restore an organization-bound AI webhook configuration with an attributed administrative audit." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4ce1438baa79a05a362fa015d353c0a632f6b67ae176b5e6c42407912852cbe2", "currentRequestSchemaSha256": "4ce1438baa79a05a362fa015d353c0a632f6b67ae176b5e6c42407912852cbe2", - "newRequestProperties": [ - "body", - "webhookId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.update_webhook", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.update_webhook", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/{webhookId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the selected AI webhook configuration within its explicit organization. Omit signingSecret or supply an empty value to preserve it; a supplied nonempty secret rotates it without readback." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -2618,29 +1681,32 @@ "description": "Replace the selected AI webhook configuration within its explicit organization. Omit signingSecret or supply an empty value to preserve it; a supplied nonempty secret rotates it without readback." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "23451efcded60b4395d7a0cabb962025c07e7ecbe70ea116afe2861279d73cc5", "currentRequestSchemaSha256": "23451efcded60b4395d7a0cabb962025c07e7ecbe70ea116afe2861279d73cc5", - "newRequestProperties": [ - "body", - "webhookId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_ai_assistant.webhook_configurations", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_ai_assistant.webhook_configurations", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/ai-assistant-webhooks/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List AI webhook configurations for one explicit organization, including enabled/archived state and signing-secret availability; stored secrets remain write-only." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2651,28 +1717,32 @@ "description": "List AI webhook configurations for one explicit organization, including enabled/archived state and signing-secret availability; stored secrets remain write-only." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "15b67354f0e2c01b53b248fd8dbe0d81875fae10633208adf50fe1888025eca0", "currentRequestSchemaSha256": "15b67354f0e2c01b53b248fd8dbe0d81875fae10633208adf50fe1888025eca0", - "newRequestProperties": [ - "organizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_attachments.download", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_attachments.download", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/attachments/{attachmentId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read a bounded attachment as base64 with its media type and filename; maximum file size is 1 MiB." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2683,28 +1753,32 @@ "description": "Read a bounded attachment as base64 with its media type and filename; maximum file size is 1 MiB." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0d03de58abb27c5d5ad11f7b09974c39c9fdedcb19b151ed660135b10faa1596", "currentRequestSchemaSha256": "0d03de58abb27c5d5ad11f7b09974c39c9fdedcb19b151ed660135b10faa1596", - "newRequestProperties": [ - "attachmentId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Parent ticket visibility; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_attachments.list", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_attachments.list", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tickets/{ticketId}/attachments/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List authorized attachment metadata for an incident, request or change." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2715,28 +1789,32 @@ "description": "List authorized attachment metadata for an incident, request or change." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c6743d0c7204e68c59160be73539271d484fd9102b2a5254d5048e0c33a511b4", "currentRequestSchemaSha256": "c6743d0c7204e68c59160be73539271d484fd9102b2a5254d5048e0c33a511b4", - "newRequestProperties": [ - "ticketId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Parent ticket visibility; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_attachments.upload", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_attachments.upload", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/attachments/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Upload one base64 attachment, at most 1 MiB, using the authenticated multipart endpoint. The API enforces the parent ticket's authority." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2747,23 +1825,18 @@ "description": "Upload one base64 attachment, at most 1 MiB, using the authenticated multipart endpoint. The API enforces the parent ticket's authority." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "2e07f0d1af2d857b51baa4ae64ff38bfc4639ef517eaa21955d1eb86ace53df7", "currentRequestSchemaSha256": "2e07f0d1af2d857b51baa4ae64ff38bfc4639ef517eaa21955d1eb86ace53df7", - "newRequestProperties": [ - "body", - "ticketId" - ], + "newRequestProperties": [], "effect": "write", "authority": "Parent ticket manager or authorized self-service owner; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_auth.access", @@ -2787,21 +1860,7 @@ "confirmationRequired": false, "description": "Read the current downstream execution principal's API permissions, organization scope and linked customer; external HTTP ingress identity remains separate." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -2813,13 +1872,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_auth.revoke_self", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_auth.revoke_self", + "baselineContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/integration-credentials/self/revoke", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Revoke the credential used by this request. The next authenticated call will fail until a separately authorized credential is supplied. This cannot issue or broaden another credential." + }, "currentContract": { "requestContract": "None", "method": "POST", @@ -2832,7 +1899,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "write", @@ -2841,7 +1908,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_auth.status", @@ -2865,21 +1932,7 @@ "confirmationRequired": false, "description": "Read the authenticated agent status." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -2891,13 +1944,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.approve_task", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.approve_task", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/approval/approve", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Approve the caller's own assigned pending task before its deadline; resumes the workflow. Repeating the same accepted decision is idempotent." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -2908,28 +1969,32 @@ "description": "Approve the caller's own assigned pending task before its deadline; resumes the workflow. Repeating the same accepted decision is idempotent." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1fe4fddfded31c5723aebf6b42233c129d6c617f65607b6b83128d06e3f96341", "currentRequestSchemaSha256": "1fe4fddfded31c5723aebf6b42233c129d6c617f65607b6b83128d06e3f96341", - "newRequestProperties": [ - "taskId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "Stored designated approver identity plus Request.User, SelfService.User or request management authority in the request organization; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.approver_candidates", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.approver_candidates", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-task-approvers", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Find designated user/customer approval candidates for a self-service task template." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2940,30 +2005,32 @@ "description": "Find designated user/customer approval candidates for a self-service task template." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "347aaac7007365a283479ac1adde24a74a237e936f9ec019654257553d4610c8", "currentRequestSchemaSha256": "347aaac7007365a283479ac1adde24a74a237e936f9ec019654257553d4610c8", - "newRequestProperties": [ - "organizationId", - "pageSize", - "q" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.binding_by_task", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.binding_by_task", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings/by-task", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Resolve the binding for one task template in one form." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -2974,29 +2041,32 @@ "description": "Resolve the binding for one task template in one form." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4979b1987ac45545109581fa5ac676b06c18be25bdf53268ddd97b693161f6b5", "currentRequestSchemaSha256": "4979b1987ac45545109581fa5ac676b06c18be25bdf53268ddd97b693161f6b5", - "newRequestProperties": [ - "requestFormId", - "taskTemplateId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.binding_drift_preview", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.binding_drift_preview", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/drift-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Compare the saved form inputs and provider target schema before importing." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3007,28 +2077,32 @@ "description": "Compare the saved form inputs and provider target schema before importing." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", - "newRequestProperties": [ - "bindingId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.binding_issues", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.binding_issues", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/orchestration/binding-issues", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3039,29 +2113,32 @@ "description": "Read bounded workflow operational evidence and pending recovery work." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", "currentRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", - "newRequestProperties": [ - "page", - "pageSize" - ], + "newRequestProperties": [], "effect": "read", "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.bindings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.bindings", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List automation bindings, optionally for one request form." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3072,28 +2149,32 @@ "description": "List automation bindings, optionally for one request form." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1aea4241843e192bb5930abeae6fcfa43f40892c639b6d4547f3ea064782d7d7", "currentRequestSchemaSha256": "1aea4241843e192bb5930abeae6fcfa43f40892c639b6d4547f3ea064782d7d7", - "newRequestProperties": [ - "requestFormId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.callback_rejections", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.callback_rejections", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/orchestration/callback-rejections", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3104,30 +2185,32 @@ "description": "Read bounded workflow operational evidence and pending recovery work." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1160d40b1278e86e92e2e901a0923f320fd4a5dd6035c9c3499ac4536267cbec", "currentRequestSchemaSha256": "1160d40b1278e86e92e2e901a0923f320fd4a5dd6035c9c3499ac4536267cbec", - "newRequestProperties": [ - "lookbackDays", - "page", - "pageSize" - ], + "newRequestProperties": [], "effect": "read", "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.create_binding", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.create_binding", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Bind a form task template to a provider request definition through a saved connection." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -3138,28 +2221,32 @@ "description": "Bind a form task template to a provider request definition through a saved connection." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "55e1245de181d40388a98dc335aeacc69b98fbf7c24762fa05c2e8f5a8c44999", "currentRequestSchemaSha256": "55e1245de181d40388a98dc335aeacc69b98fbf7c24762fa05c2e8f5a8c44999", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.create_form", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.create_form", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-forms/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a self-service request form with a typed fields/tasks schema. Set releaseStatus, audience and each automation task's autoStart deliberately. Task IDs and dependency IDs are UUIDs; the API validates the dependency graph and dataset bindings." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -3170,29 +2257,24 @@ "description": "Create a self-service request form with a typed fields/tasks schema. Set releaseStatus, audience and each automation task's autoStart deliberately. Task IDs and dependency IDs are UUIDs; the API validates the dependency graph and dataset bindings." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1e4f5aa05a5417447047c3d09c4d80041fe48f6c3e9fe38d57eb2cc7cc773fdf", "currentRequestSchemaSha256": "1e4f5aa05a5417447047c3d09c4d80041fe48f6c3e9fe38d57eb2cc7cc773fdf", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.create_request_definition", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, - "currentContract": { + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.create_request_definition", + "baselineContract": { "requestContract": "OperatorRequest", "method": "POST", "pathTemplate": "/api/v1/admin/orchestration/catalog/request-definitions", @@ -3201,31 +2283,42 @@ "confirmationRequired": true, "description": "Create a provider automation target using the selected saved organization mapping. This creates a request definition through the supported provider adapter." }, - "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/catalog/request-definitions", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a provider automation target using the selected saved organization mapping. This creates a request definition through the supported provider adapter." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "f92cd7fece53e87b07c0ccd85ba23ace40b4f1f59e24bcf679e034e8e0a76268", "currentRequestSchemaSha256": "f92cd7fece53e87b07c0ccd85ba23ace40b4f1f59e24bcf679e034e8e0a76268", - "newRequestProperties": [ - "body", - "connectionId", - "organizationId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.create_rule", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.create_rule", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/automation/rules/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an automation rule through the same canonical API as the administration screen. Conditions and actions retain the API's text representation; this operation saves the rule and does not claim a provider execution." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -3236,28 +2329,32 @@ "description": "Create an automation rule through the same canonical API as the administration screen. Conditions and actions retain the API's text representation; this operation saves the rule and does not claim a provider execution." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "6ab1987040a166685ac43911c74c2c2fbad0b129ac530a1c92cfea4064e12638", "currentRequestSchemaSha256": "6ab1987040a166685ac43911c74c2c2fbad0b129ac530a1c92cfea4064e12638", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.critical_failures", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.critical_failures", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/critical-failures", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3268,30 +2365,32 @@ "description": "Read bounded workflow operational evidence and pending recovery work." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "700530b374da8bdbf7d2c408ccf6b3fc4b30854930ff5ee0c825cffe25bc858d", "currentRequestSchemaSha256": "700530b374da8bdbf7d2c408ccf6b3fc4b30854930ff5ee0c825cffe25bc858d", - "newRequestProperties": [ - "page", - "pageSize", - "sinceUtc" - ], + "newRequestProperties": [], "effect": "read", "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.delete_binding", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.delete_binding", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one automation binding." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -3302,28 +2401,32 @@ "description": "Delete one automation binding." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", - "newRequestProperties": [ - "bindingId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.delete_rule", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.delete_rule", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/automation/rules/{ruleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete exactly one selected automation rule." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -3334,28 +2437,32 @@ "description": "Delete exactly one selected automation rule." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", - "newRequestProperties": [ - "ruleId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.escalated_tasks", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.escalated_tasks", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/escalated", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3366,29 +2473,32 @@ "description": "Read bounded workflow operational evidence and pending recovery work." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", "currentRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", - "newRequestProperties": [ - "page", - "pageSize" - ], + "newRequestProperties": [], "effect": "read", "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.get_binding", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.get_binding", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one saved automation binding." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3399,28 +2509,32 @@ "description": "Read one saved automation binding." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", - "newRequestProperties": [ - "bindingId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.get_rule", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.get_rule", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/automation/rules/{ruleId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one saved automation rule before editing or deleting it." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3431,28 +2545,32 @@ "description": "Read one saved automation rule before editing or deleting it." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", - "newRequestProperties": [ - "ruleId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.import_binding_inputs", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.import_binding_inputs", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/import-inputs", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Import the bound provider input definitions into the form task template." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -3463,28 +2581,32 @@ "description": "Import the bound provider input definitions into the form task template." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", - "newRequestProperties": [ - "bindingId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.mark_binding_import_pending", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.mark_binding_import_pending", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/mark-import-pending", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Mark a binding for explicit reviewed schema import." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -3495,28 +2617,32 @@ "description": "Mark a binding for explicit reviewed schema import." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", - "newRequestProperties": [ - "bindingId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.my_task_approval", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.my_task_approval", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/request-tasks/{taskId}/approval/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the caller's assigned approval. Even an owner grant cannot impersonate another designated approver." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3527,29 +2653,33 @@ "description": "Read the caller's assigned approval. Even an owner grant cannot impersonate another designated approver." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1fe4fddfded31c5723aebf6b42233c129d6c617f65607b6b83128d06e3f96341", "currentRequestSchemaSha256": "1fe4fddfded31c5723aebf6b42233c129d6c617f65607b6b83128d06e3f96341", - "newRequestProperties": [ - "taskId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Stored designated approver identity plus Request.User, SelfService.User or request management authority in the request organization; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.overdue_tasks", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, - "currentContract": { + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.overdue_tasks", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/overdue", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, + "currentContract": { "requestContract": "OperatorRequest", "method": "GET", "pathTemplate": "/api/v1/ops/tasks/overdue", @@ -3559,29 +2689,32 @@ "description": "Read bounded workflow operational evidence and pending recovery work." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", "currentRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", - "newRequestProperties": [ - "page", - "pageSize" - ], + "newRequestProperties": [], "effect": "read", "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.pending_retries", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.pending_retries", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ops/tasks/retries-pending", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded workflow operational evidence and pending recovery work." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3592,29 +2725,32 @@ "description": "Read bounded workflow operational evidence and pending recovery work." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", "currentRequestSchemaSha256": "ec229157d903257f462c789d728d74ab7a70ce875f1ffce4817db82723de9747", - "newRequestProperties": [ - "page", - "pageSize" - ], + "newRequestProperties": [], "effect": "read", "authority": "Request.Manager in an authorized organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.refresh_binding_drift", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.refresh_binding_drift", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/refresh-drift", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Refresh provider schema drift for saved bindings, optionally limited to a form." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -3625,28 +2761,32 @@ "description": "Refresh provider schema drift for saved bindings, optionally limited to a form." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1aea4241843e192bb5930abeae6fcfa43f40892c639b6d4547f3ea064782d7d7", "currentRequestSchemaSha256": "1aea4241843e192bb5930abeae6fcfa43f40892c639b6d4547f3ea064782d7d7", - "newRequestProperties": [ - "requestFormId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.reject_task", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.reject_task", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/request-tasks/{taskId}/approval/reject", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Reject the caller's own assigned pending task with a reason through the canonical cancellation and notification lifecycle." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -3657,29 +2797,32 @@ "description": "Reject the caller's own assigned pending task with a reason through the canonical cancellation and notification lifecycle." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "2d4ada835af85af7b4b955da370e4c23b1a5ca40aa009a025757d86bbf352ed8", "currentRequestSchemaSha256": "2d4ada835af85af7b4b955da370e4c23b1a5ca40aa009a025757d86bbf352ed8", - "newRequestProperties": [ - "body", - "taskId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "Stored designated approver identity plus Request.User, SelfService.User or request management authority in the request organization; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.rules", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.rules", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/automation/rules/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List saved automation rules with their trigger, conditions and actions." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -3692,7 +2835,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -3701,13 +2844,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.sync_binding_inputs", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.sync_binding_inputs", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}/sync-inputs", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Synchronize the form task inputs with its bound automation target." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -3718,28 +2869,32 @@ "description": "Synchronize the form task inputs with its bound automation target." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", "currentRequestSchemaSha256": "8dccea4c32c37345c0f9ec91d4c22641bc6f4d4b4135b2cdf8f36ccd34b40e8c", - "newRequestProperties": [ - "bindingId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.update_binding", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.update_binding", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/orchestration/bindings/{bindingId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update or enable/disable an existing automation binding. Omitted properties retain their current values; explicit clear fields remove optional values." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -3750,29 +2905,32 @@ "description": "Update or enable/disable an existing automation binding. Omitted properties retain their current values; explicit clear fields remove optional values." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d7c6b62307d379ad68e39f1c796166beb2e92eec8c89378a1465853c6828ab96", "currentRequestSchemaSha256": "d7c6b62307d379ad68e39f1c796166beb2e92eec8c89378a1465853c6828ab96", - "newRequestProperties": [ - "bindingId", - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.update_form", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.update_form", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/request-forms/{requestFormId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Edit a self-service form through its typed fields/tasks schema; omitted audience and release status remain unchanged. Existing bindings are managed separately through binding operations." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -3783,29 +2941,32 @@ "description": "Edit a self-service form through its typed fields/tasks schema; omitted audience and release status remain unchanged. Existing bindings are managed separately through binding operations." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a29b12eab2512bbfefb570657d3147b75619c4e25c104a48d4c795211c239765", "currentRequestSchemaSha256": "a29b12eab2512bbfefb570657d3147b75619c4e25c104a48d4c795211c239765", - "newRequestProperties": [ - "body", - "requestFormId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.update_rule", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.update_rule", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/automation/rules/{ruleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the selected rule's name, trigger, conditions and actions. Read the current rule first; explicitly supply null conditions/actions to clear them. The route determines the stored identifier." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -3816,29 +2977,32 @@ "description": "Replace the selected rule's name, trigger, conditions and actions. Read the current rule first; explicitly supply null conditions/actions to clear them. The route determines the stored identifier." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9cb2954af965bef8734cd17ac5ccbdfc6f040db93e991e4778f9670cc6626bb3", "currentRequestSchemaSha256": "9cb2954af965bef8734cd17ac5ccbdfc6f040db93e991e4778f9670cc6626bb3", - "newRequestProperties": [ - "body", - "ruleId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.workflow_metrics", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.workflow_metrics", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/metrics/workflows", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read organization-filtered workflow operational counters as Prometheus text." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -3846,27 +3010,35 @@ "effect": "read", "readOnly": true, "confirmationRequired": false, - "description": "Read workflow operational counters." + "description": "Read organization-filtered workflow operational counters as Prometheus text." }, "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", - "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "authority": "Request.Read, Request.Write or Request.Manager in the selected organizations; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { - "support": "denied_by_policy", - "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + "support": "permission_and_organization_intersection", + "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_automation.workflow_timeline", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_automation.workflow_timeline", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/workflow-timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read independently persisted request workflow events, including provider execution identities and effects." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -3877,28 +3049,18 @@ "description": "Read independently persisted request workflow events, including provider execution identities and effects." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a45d3ae7091d129e9b2a30d7ed533d1a31ddfebfdb24b572afa57bde01b738ae", "currentRequestSchemaSha256": "a45d3ae7091d129e9b2a30d7ed533d1a31ddfebfdb24b572afa57bde01b738ae", - "newRequestProperties": [ - "categories", - "correlationId", - "includePayload", - "page", - "pageSize", - "requestId", - "sinceUtc" - ], + "newRequestProperties": [], "effect": "read", "authority": "Request.Manager in the request organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_capabilities.get", @@ -3922,21 +3084,7 @@ "confirmationRequired": false, "description": "Read the supported catalog revision and safety policy." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -3948,7 +3096,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_categories.list", @@ -3972,21 +3120,7 @@ "confirmationRequired": false, "description": "list operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "e5af278af7c144fdce2abbb954a0e065fba87142ca9082e2e9e6073d93e06589", @@ -3998,7 +3132,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.add_worklog", @@ -4022,21 +3156,7 @@ "confirmationRequired": true, "description": "add_worklog changes." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "7de1dd86895476bdacfe03853afb55d22ec3e5d1c91930c3b2352da5dbc086c3", @@ -4048,7 +3168,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.assign", @@ -4072,30 +3192,7 @@ "confirmationRequired": true, "description": "assign operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "842827923aa61233aa4f64d5448bebd3d88feda547c9b1e73bf1926da6172a1d", @@ -4107,7 +3204,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.assign_self", @@ -4131,30 +3228,7 @@ "confirmationRequired": true, "description": "assign_self operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "30ebfb7a4cc9a6ec6e8683a2e0cdcd6498f97ca3c1aed365b6c9ae11c2c38b35", @@ -4166,7 +3240,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.attachments_count", @@ -4190,21 +3264,7 @@ "confirmationRequired": false, "description": "Read attachments_count for one change." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "cc875cb7ce87f425fcef9c2c926476f9bd3fec679f581dbbeb998e22d5644dd9", @@ -4216,7 +3276,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.bulk_create", @@ -4240,21 +3300,7 @@ "confirmationRequired": true, "description": "bulk_create operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "be79296334f10556234d46e60e22996aa6ff3d59b37e56e2271789e20b3120d4", @@ -4266,7 +3312,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.bulk_state", @@ -4290,30 +3336,7 @@ "confirmationRequired": true, "description": "bulk_state operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "7a5d5a7b3806022860520b6e8f54f389a80323ff152aff3a6c29206db976895e", @@ -4325,7 +3348,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.create", @@ -4349,21 +3372,7 @@ "confirmationRequired": true, "description": "create changes." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "12ca8c271900018bde9ae11ffccc0a71da5c2777511bccd36e8057b4f2c66222", @@ -4375,7 +3384,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.delete", @@ -4399,21 +3408,7 @@ "confirmationRequired": true, "description": "delete changes." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "fe0321856d0816a3e975e77a3e8343f1345a3dbc2bb86f26b803a3a51d429cc2", @@ -4425,7 +3420,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.get", @@ -4449,21 +3444,7 @@ "confirmationRequired": false, "description": "get changes." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "da155b1fffe3c9848e285f0d482650a719b1231dcbcafd23a6053813cc3a16fb", @@ -4475,7 +3456,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.lifecycle", @@ -4499,21 +3480,7 @@ "confirmationRequired": true, "description": "lifecycle changes." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "1364a04afbe32b11adf3161f16c094c04a8bb5729c6e3588c582ed5aca020551", @@ -4525,7 +3492,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.list", @@ -4549,21 +3516,7 @@ "confirmationRequired": false, "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "dcaa76efcf00151d520423322ac2a98c4558b9595d6f0e59b07f1e3abb6a6751", @@ -4575,7 +3528,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.listeners_count", @@ -4599,21 +3552,7 @@ "confirmationRequired": false, "description": "Read listeners_count for one change." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "48616b0970c4d5839a9c47a5af2f764b10c1228cfb6e1285cbbf2f9fbcb4e662", @@ -4625,13 +3564,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.my_approval", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.my_approval", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/changes/{changeId}/approval/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the caller's designated change approval. An owner cannot substitute another approver's identity." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -4642,28 +3589,32 @@ "description": "Read the caller's designated change approval. An owner cannot substitute another approver's identity." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c476896b2e994402c94f6d5d7a4391f019c6dc4d635fbc8fd3ce471daffc13e2", "currentRequestSchemaSha256": "c476896b2e994402c94f6d5d7a4391f019c6dc4d635fbc8fd3ce471daffc13e2", - "newRequestProperties": [ - "changeId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Stored designated approver identity and current change visibility or approval authority; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.review_approval", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_changes.review_approval", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/changes/{changeId}/approval/review", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Review and approve the caller's own pending change approval. The last required review advances the change to ApprovedForImplementation and queues its timeline and notifications. Signed and authenticated decisions serialize together; a repeated committed review adds no duplicate effects. On 409 read my_approval before another action." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -4674,22 +3625,18 @@ "description": "Review and approve the caller's own pending change approval. The last required review advances the change to ApprovedForImplementation and queues its timeline and notifications. Signed and authenticated decisions serialize together; a repeated committed review adds no duplicate effects. On 409 read my_approval before another action." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c476896b2e994402c94f6d5d7a4391f019c6dc4d635fbc8fd3ce471daffc13e2", "currentRequestSchemaSha256": "c476896b2e994402c94f6d5d7a4391f019c6dc4d635fbc8fd3ce471daffc13e2", - "newRequestProperties": [ - "changeId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "Stored designated approver identity and current change visibility or approval authority; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.state", @@ -4713,21 +3660,7 @@ "confirmationRequired": true, "description": "state changes." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "a12ed4542e95fe48a0e95dcff75320aabb97bd95acfcb21fab846a72001391c6", @@ -4739,7 +3672,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.timeline", @@ -4763,21 +3696,7 @@ "confirmationRequired": false, "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "642b8eca27898da8287e6761ddd8e79665ce2da87156b1b3fd0e9776c7b379a2", @@ -4789,7 +3708,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.timeline_count", @@ -4813,21 +3732,7 @@ "confirmationRequired": false, "description": "Read timeline_count for one change." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "c101d221f5093b33857ff6bea82b5f61631e12d67afd76702067436af98205ee", @@ -4839,7 +3744,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.update", @@ -4863,21 +3768,7 @@ "confirmationRequired": true, "description": "update changes." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "e35ca9e7721f2b81dda2a234e062bc46eef13f662da428058a72cbc0ea974c1c", @@ -4889,7 +3780,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_changes.worklogs", @@ -4913,21 +3804,7 @@ "confirmationRequired": false, "description": "worklogs changes." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "9135d2d92b70ff7b399633b36d09bea6b2051c42eaf753037ab6e0931b8b9685", @@ -4939,7 +3816,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_config.get", @@ -4963,21 +3840,7 @@ "confirmationRequired": false, "description": "Read an allowlisted persisted configuration value." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "2f063235da9d41967aae618e5b931f9057dc5b7f849edeab041db96411770264", @@ -4989,7 +3852,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_config.set", @@ -5013,21 +3876,7 @@ "confirmationRequired": true, "description": "Set an allowlisted non-secret configuration value." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "unavailable_by_policy_on_http", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "5870b2f9773b36c1acb971df21f03a42c1ebbc88652f0a4337b6fb1679f4127d", @@ -5039,7 +3888,7 @@ "support": "unavailable_by_policy_on_http", "reason": "HTTP configuration surface is read-only. Local stdio persistence requires configurationWritesEnabled=true." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_config.show", @@ -5063,21 +3912,7 @@ "confirmationRequired": false, "description": "Read redacted configuration." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -5089,7 +3924,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_config.unset", @@ -5113,21 +3948,7 @@ "confirmationRequired": true, "description": "Unset an allowlisted non-secret configuration value." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "unavailable_by_policy_on_http", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "a56eab90b01ee13504b74c437efb9afeea24c18bde9f7cee7cc8d582f3593ec0", @@ -5139,13 +3960,21 @@ "support": "unavailable_by_policy_on_http", "reason": "HTTP configuration surface is read-only. Local stdio persistence requires configurationWritesEnabled=true." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.confirm_netclaw_session_owner", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.confirm_netclaw_session_owner", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/legacy-sessions/confirm-owner", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Bind explicitly reviewed legacy conversation IDs to their actual historical Netclaw endpoint and instance. expectedEligibleConversations must equal the unique submitted IDs. The API compares current eligibility and commits its owner audit; reload on a conflict before submitting a new reviewed selection." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -5156,28 +3985,32 @@ "description": "Bind explicitly reviewed legacy conversation IDs to their actual historical Netclaw endpoint and instance. expectedEligibleConversations must equal the unique submitted IDs. The API compares current eligibility and commits its owner audit; reload on a conflict before submitting a new reviewed selection." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "94c086ba358ea93bf11a67f8640dc01b07f21d58f5a8e2076e38e8027bf91b84", "currentRequestSchemaSha256": "94c086ba358ea93bf11a67f8640dc01b07f21d58f5a8e2076e38e8027bf91b84", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.delete_mapping", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.delete_mapping", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/mappings/{mappingId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Remove one saved named mapping from the paired systems." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -5188,29 +4021,32 @@ "description": "Remove one saved named mapping from the paired systems." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8ea9563a57448e08c8c3cb3c5d7430a4ffa560b89fa9e40a020df6a5ae83d182", "currentRequestSchemaSha256": "8ea9563a57448e08c8c3cb3c5d7430a4ffa560b89fa9e40a020df6a5ae83d182", - "newRequestProperties": [ - "mappingId", - "pairId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.delete_pair", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.delete_pair", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete a saved pair and its mappings through the supported cleanup lifecycle." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -5221,28 +4057,32 @@ "description": "Delete a saved pair and its mappings through the supported cleanup lifecycle." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a93a708ce637c66585c9df9854e5187361fd8fe346bd8dd0dc43028488f9f1f4", "currentRequestSchemaSha256": "a93a708ce637c66585c9df9854e5187361fd8fe346bd8dd0dc43028488f9f1f4", - "newRequestProperties": [ - "pairId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.directory", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.directory", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/directory", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read authorized organization, customer and provider-tenant choices for a saved pair." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -5253,28 +4093,32 @@ "description": "Read authorized organization, customer and provider-tenant choices for a saved pair." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a93a708ce637c66585c9df9854e5187361fd8fe346bd8dd0dc43028488f9f1f4", "currentRequestSchemaSha256": "a93a708ce637c66585c9df9854e5187361fd8fe346bd8dd0dc43028488f9f1f4", - "newRequestProperties": [ - "pairId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.generate_pairing_code", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.generate_pairing_code", + "baselineContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/admin/system-connections/code", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Generate an expiring single-use system pairing code as a sensitive result. Deliver only to the authorized peer setup workflow; exclude it from campaign evidence and logs." + }, "currentContract": { "requestContract": "None", "method": "POST", @@ -5287,7 +4131,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "write", @@ -5296,13 +4140,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.incident_sources", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.incident_sources", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/integrations/netratel/sources/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List the configured incident receiver source namespaces, organization/customer targets, enabled state and revision." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -5315,7 +4167,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -5324,13 +4176,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.list", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.list", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/system-connections/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List saved system connections and their health without returning peer credentials." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -5343,7 +4203,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -5352,13 +4212,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.netclaw_settings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.netclaw_settings", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/netclaw/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved Netclaw connectivity metadata with secret-state flags." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -5371,7 +4239,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -5380,13 +4248,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.netclaw_unbound_sessions", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.netclaw_unbound_sessions", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/netclaw/legacy-sessions/unbound", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the exact legacy conversation IDs, ticket and organization context that still need historical Netclaw provider ownership confirmation." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -5399,7 +4275,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -5408,13 +4284,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.pair", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.pair", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/system-connections/pair", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Connect to an explicitly selected peer using its supplied short-lived write-only pairing code. Reuse the same operationId when reading the result of an uncertain attempt; the canonical signed peer protocol, address validation and owner checks apply." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -5425,28 +4309,32 @@ "description": "Connect to an explicitly selected peer using its supplied short-lived write-only pairing code. Reuse the same operationId when reading the result of an uncertain attempt; the canonical signed peer protocol, address validation and owner checks apply." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a70dbaae415894c19917969c4b2e0631e0470970d2ab55b4e57fa6f7003235f3", "currentRequestSchemaSha256": "a70dbaae415894c19917969c4b2e0631e0470970d2ab55b4e57fa6f7003235f3", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.pair_netclaw", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.pair_netclaw", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/pair-and-save", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Exchange a supplied one-time Netclaw pairing code, save the resulting protected device credential, and verify the authenticated session. Read netclaw_settings first and supply its current expectedRevision. If older unbound conversations exist, inspect netclaw_unbound_sessions and confirm their actual historical provider with confirm_netclaw_session_owner before pairing. On conflict or uncertain verification read the saved profile; a consumed pairing code must not be blindly replayed. Native Netclaw pairing requires its PostgreSQL durable-session capability." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -5457,28 +4345,32 @@ "description": "Exchange a supplied one-time Netclaw pairing code, save the resulting protected device credential, and verify the authenticated session. Read netclaw_settings first and supply its current expectedRevision. If older unbound conversations exist, inspect netclaw_unbound_sessions and confirm their actual historical provider with confirm_netclaw_session_owner before pairing. On conflict or uncertain verification read the saved profile; a consumed pairing code must not be blindly replayed. Native Netclaw pairing requires its PostgreSQL durable-session capability." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c3429cf4aadbe31c628a66dd18076b78221129835ad7508460f258fa08553a2d", "currentRequestSchemaSha256": "c3429cf4aadbe31c628a66dd18076b78221129835ad7508460f258fa08553a2d", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.register_incident_source", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.register_incident_source", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/integrations/netratel/sources/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Register a NetRatel source instance against an enabled organization/customer and an existing valid API-purpose credential. The API validates that credential's owner, organization, purpose, expiry and revocation; this operation does not issue a new credential." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -5489,28 +4381,32 @@ "description": "Register a NetRatel source instance against an enabled organization/customer and an existing valid API-purpose credential. The API validates that credential's owner, organization, purpose, expiry and revocation; this operation does not issue a new credential." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "68e2b6bb6e8c1d8eb5bb566bfacc3409843c4d4699b041cdc24dbea97aeef511", "currentRequestSchemaSha256": "68e2b6bb6e8c1d8eb5bb566bfacc3409843c4d4699b041cdc24dbea97aeef511", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.save_mapping", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.save_mapping", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/mappings/{mappingId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Create or update a named organization/provider mapping on an existing securely paired peer. body.id must equal mappingId and body.pairId must equal pairId." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -5521,30 +4417,32 @@ "description": "Create or update a named organization/provider mapping on an existing securely paired peer. body.id must equal mappingId and body.pairId must equal pairId." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "3677a9a5250df6a612308b6d33363a62102b3e422e7bada1de5199cd83976c19", "currentRequestSchemaSha256": "3677a9a5250df6a612308b6d33363a62102b3e422e7bada1de5199cd83976c19", - "newRequestProperties": [ - "body", - "mappingId", - "pairId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.set_incident_source_credential", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.set_incident_source_credential", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/integrations/netratel/sources/{namespaceId}/principal-bindings/{credentialId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable or disable an explicitly selected API credential binding for a source namespace at its current expectedRevision. The API verifies active credentials belong to the source organization and persists the source audit." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -5555,30 +4453,32 @@ "description": "Enable or disable an explicitly selected API credential binding for a source namespace at its current expectedRevision. The API verifies active credentials belong to the source organization and persists the source audit." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "40f5d924e56d901ceaf61de6c63622f57e1fd743c118de2703f29a14984ef398", "currentRequestSchemaSha256": "40f5d924e56d901ceaf61de6c63622f57e1fd743c118de2703f29a14984ef398", - "newRequestProperties": [ - "body", - "credentialId", - "namespaceId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.set_incident_source_state", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.set_incident_source_state", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PATCH", + "pathTemplate": "/api/v1/integrations/netratel/sources/{namespaceId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable or disable a registered incident source at its currently read expectedRevision. Concurrent changes return conflict; read the source again before a reviewed update." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PATCH", @@ -5589,29 +4489,32 @@ "description": "Enable or disable a registered incident source at its currently read expectedRevision. Concurrent changes return conflict; read the source again before a reviewed update." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "37e825cbd351ff7833da23c654d85d2f9c30946bacf249c9db2ac99653f7cff2", "currentRequestSchemaSha256": "37e825cbd351ff7833da23c654d85d2f9c30946bacf249c9db2ac99653f7cff2", - "newRequestProperties": [ - "body", - "namespaceId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.test_mapping", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.test_mapping", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/system-connections/{pairId}/mappings/{mappingId}/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test the exact saved mapping's approved capabilities and organization binding." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -5622,29 +4525,32 @@ "description": "Test the exact saved mapping's approved capabilities and organization binding." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8ea9563a57448e08c8c3cb3c5d7430a4ffa560b89fa9e40a020df6a5ae83d182", "currentRequestSchemaSha256": "8ea9563a57448e08c8c3cb3c5d7430a4ffa560b89fa9e40a020df6a5ae83d182", - "newRequestProperties": [ - "mappingId", - "pairId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.test_netclaw", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.test_netclaw", + "baselineContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test the saved Netclaw connection and authenticated session protocol." + }, "currentContract": { "requestContract": "None", "method": "POST", @@ -5657,7 +4563,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "external_io", @@ -5666,13 +4572,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.test_netclaw_draft", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.test_netclaw_draft", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/admin/netclaw/test-draft", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test an explicit Netclaw settings draft through the authenticated session protocol without saving it. Omitted deviceToken retains the saved credential only where its endpoint binding matches. Read the saved profile and revision first." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -5683,28 +4597,32 @@ "description": "Test an explicit Netclaw settings draft through the authenticated session protocol without saving it. Omitted deviceToken retains the saved credential only where its endpoint binding matches. Read the saved profile and revision first." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9226997f78d3afd4dbd0b739076b3be64edfe3483222f1d4142b30992cafb278", "currentRequestSchemaSha256": "9226997f78d3afd4dbd0b739076b3be64edfe3483222f1d4142b30992cafb278", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connections.update_netclaw_settings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_connections.update_netclaw_settings", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/netclaw/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update Netclaw connectivity settings with optional write-only device-token replacement or explicit clearing. Omit the token to preserve its protected saved value. expectedRevision enforces concurrent-update detection." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -5715,22 +4633,18 @@ "description": "Update Netclaw connectivity settings with optional write-only device-token replacement or explicit clearing. Omit the token to preserve its protected saved value. expectedRevision enforces concurrent-update detection." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9226997f78d3afd4dbd0b739076b3be64edfe3483222f1d4142b30992cafb278", "currentRequestSchemaSha256": "9226997f78d3afd4dbd0b739076b3be64edfe3483222f1d4142b30992cafb278", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connectivity.orchestration", @@ -5754,30 +4668,7 @@ "confirmationRequired": false, "description": "orchestration operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "999529a4d3fafcc549e1da54fb9e5533ce02459801b4806131914ff1947a665e", @@ -5789,7 +4680,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connectivity.orchestration_bindings", @@ -5813,30 +4704,7 @@ "confirmationRequired": false, "description": "orchestration_bindings operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -5848,7 +4716,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connectivity.orchestration_jobs", @@ -5872,30 +4740,7 @@ "confirmationRequired": false, "description": "orchestration_jobs operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "e6702a985facf6fab0a19a362452dcfb6e84ce899b8f840d8f4fb3539fccf5b2", @@ -5907,7 +4752,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connectivity.orchestration_request_definitions", @@ -5931,30 +4776,7 @@ "confirmationRequired": false, "description": "orchestration_request_definitions operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "85518a42d3451359a90a5482825db311b9b13a31a3863f4c48720145fac5c15f", @@ -5966,7 +4788,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connectivity.orchestration_tenants", @@ -5990,30 +4812,7 @@ "confirmationRequired": false, "description": "orchestration_tenants operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "e15499f542cdebd1dd53bee182ab76cf12feb4717272ee520f8e9057230313fd", @@ -6025,7 +4824,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_connectivity.orchestration_test", @@ -6049,30 +4848,7 @@ "confirmationRequired": true, "description": "orchestration_test operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "36b6b0d03ea3b68a747aeeccab537775e3386d420d77054bf6c69ce0af746cba", @@ -6084,7 +4860,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_customers.auth_status", @@ -6108,40 +4884,7 @@ "confirmationRequired": false, "description": "auth_status operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "prerequisites": { - "old": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Disposable existing customer and HelpdeskAdmin; configured supported authentication mode/provider. Invitations require isolated delivery capture for acceptance; Local/ambiguous identity and unavailable-provider results are distinct." - ], - "new": [ - "Configured exact API target and valid supported identity; no authentication-mode or target fallback on denial/unavailability.", - "Existing customer and HelpdeskAdmin; inspect Local/External identity-provider mode and the account linkage before selecting an activation, invitation, enable/disable or synchronization operation." - ] - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "80e7d2acdb4a3c02f03c11241a104928ef6a17e50d724ef636bc5d5440aec851", @@ -6153,7 +4896,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_customers.get", @@ -6177,30 +4920,7 @@ "confirmationRequired": false, "description": "get operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "43716bd4092be8631cf18ffb04e2a2bf8ca8671c0ad50822593d6ae592f6f718", @@ -6212,7 +4932,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_customers.list", @@ -6236,30 +4956,7 @@ "confirmationRequired": false, "description": "list operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "df8a85e4194a3ef488e8723fd153a0d16ab1fa898a3c69dc948621836b812fc6", @@ -6271,13 +4968,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.create", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.create", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a dataset with typed columns and explicit organization scope. Non-administrators remain restricted to custom sources." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -6288,29 +4993,24 @@ "description": "Create a dataset with typed columns and explicit organization scope. Non-administrators remain restricted to custom sources." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "cabb40a78a210c303a4a05b2811398ee23987bcb244074f5d0f4bd6801d14b68", "currentRequestSchemaSha256": "cabb40a78a210c303a4a05b2811398ee23987bcb244074f5d0f4bd6801d14b68", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.create_credential", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, - "currentContract": { + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.create_credential", + "baselineContract": { "requestContract": "OperatorRequest", "method": "POST", "pathTemplate": "/api/v1/resources/datasets/{datasetId}/credentials", @@ -6319,30 +5019,42 @@ "confirmationRequired": true, "description": "Create one dataset ingestion credential. Its plaintext key is returned once to this authenticated creation request; subsequent credential reads return metadata only." }, - "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/credentials", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create one dataset ingestion credential. Its plaintext key is returned once to this authenticated creation request; subsequent credential reads return metadata only." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a73707cf4a9e3d682723113c869c0f57ef2715751df6538fca480b79d91e7af3", "currentRequestSchemaSha256": "a73707cf4a9e3d682723113c869c0f57ef2715751df6538fca480b79d91e7af3", - "newRequestProperties": [ - "body", - "datasetId" - ], + "newRequestProperties": [], "effect": "write", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.credentials", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.credentials", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/credentials", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read dataset ingestion credential metadata without secret keys." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -6353,28 +5065,32 @@ "description": "Read dataset ingestion credential metadata without secret keys." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "54b9139ccae85e80ecf678bbf49d34aa607c2e111859bc26ea7eef3704452354", "currentRequestSchemaSha256": "54b9139ccae85e80ecf678bbf49d34aa607c2e111859bc26ea7eef3704452354", - "newRequestProperties": [ - "datasetId" - ], + "newRequestProperties": [], "effect": "read", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.delete", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.delete", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one authorized dataset through the canonical service." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -6385,28 +5101,32 @@ "description": "Delete one authorized dataset through the canonical service." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "54b9139ccae85e80ecf678bbf49d34aa607c2e111859bc26ea7eef3704452354", "currentRequestSchemaSha256": "54b9139ccae85e80ecf678bbf49d34aa607c2e111859bc26ea7eef3704452354", - "newRequestProperties": [ - "datasetId" - ], + "newRequestProperties": [], "effect": "write", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.get", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.get", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read an authorized dataset definition and schema." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -6417,28 +5137,32 @@ "description": "Read an authorized dataset definition and schema." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "54b9139ccae85e80ecf678bbf49d34aa607c2e111859bc26ea7eef3704452354", "currentRequestSchemaSha256": "54b9139ccae85e80ecf678bbf49d34aa607c2e111859bc26ea7eef3704452354", - "newRequestProperties": [ - "datasetId" - ], + "newRequestProperties": [], "effect": "read", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.graph_settings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.graph_settings", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/graph-settings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read Graph dataset configuration and synchronization diagnostics without stored secrets." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -6449,28 +5173,32 @@ "description": "Read Graph dataset configuration and synchronization diagnostics without stored secrets." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "231b58899eaad218374588b7f5fb49062f3dc898173989d82a324a0066c9f6d4", "currentRequestSchemaSha256": "231b58899eaad218374588b7f5fb49062f3dc898173989d82a324a0066c9f6d4", - "newRequestProperties": [ - "organizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.list", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.list", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List datasets in the explicitly selected authorized organization." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -6481,28 +5209,32 @@ "description": "List datasets in the explicitly selected authorized organization." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "231b58899eaad218374588b7f5fb49062f3dc898173989d82a324a0066c9f6d4", "currentRequestSchemaSha256": "231b58899eaad218374588b7f5fb49062f3dc898173989d82a324a0066c9f6d4", - "newRequestProperties": [ - "organizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.options", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.options", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/datasets/{datasetId}/options", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read authorized searchable dataset options for self-service form inputs." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -6513,31 +5245,32 @@ "description": "Read authorized searchable dataset options for self-service form inputs." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "5742c94998f1fdbc9959664c67de25b86f6909a4bee0917324701405a6fcaa89", "currentRequestSchemaSha256": "5742c94998f1fdbc9959664c67de25b86f6909a4bee0917324701405a6fcaa89", - "newRequestProperties": [ - "datasetId", - "page", - "pageSize", - "query" - ], + "newRequestProperties": [], "effect": "read", "authority": "SelfService.User in the dataset organization; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.revoke_credential", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.revoke_credential", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/credentials/{credentialId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Revoke one ingestion credential under the dataset's API-management authority." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -6548,29 +5281,32 @@ "description": "Revoke one ingestion credential under the dataset's API-management authority." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "92941ab6315103ac28ba97ea1aced2011a67937644def2ce0048702857daed85", "currentRequestSchemaSha256": "92941ab6315103ac28ba97ea1aced2011a67937644def2ce0048702857daed85", - "newRequestProperties": [ - "credentialId", - "datasetId" - ], + "newRequestProperties": [], "effect": "write", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.rows", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.rows", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/rows", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded, searchable dataset rows." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -6581,31 +5317,32 @@ "description": "Read bounded, searchable dataset rows." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "292132b2b9c1c333bb74852754aa6293bd2db53441d79878e5ea50c5325a1192", "currentRequestSchemaSha256": "292132b2b9c1c333bb74852754aa6293bd2db53441d79878e5ea50c5325a1192", - "newRequestProperties": [ - "datasetId", - "page", - "pageSize", - "query" - ], + "newRequestProperties": [], "effect": "read", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.save_graph_settings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.save_graph_settings", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/resources/datasets/graph-settings", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Save Graph dataset configuration, a write-only client secret and schedule controls. Omit or leave clientSecret empty to preserve its existing protected value." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -6616,28 +5353,32 @@ "description": "Save Graph dataset configuration, a write-only client secret and schedule controls. Omit or leave clientSecret empty to preserve its existing protected value." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c0595a90b41f9606bc92d6800fe4f067f649970d7cb421786f5fe28c88a29d14", "currentRequestSchemaSha256": "c0595a90b41f9606bc92d6800fe4f067f649970d7cb421786f5fe28c88a29d14", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.sync_graph", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.sync_graph", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/graph-settings/{organizationId}/sync", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Synchronize enabled built-in datasets through the saved Graph integration." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -6648,28 +5389,32 @@ "description": "Synchronize enabled built-in datasets through the saved Graph integration." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", "currentRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", - "newRequestProperties": [ - "organizationId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.update", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.update", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update a dataset definition within its actual stored organization scope." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -6680,29 +5425,32 @@ "description": "Update a dataset definition within its actual stored organization scope." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "b3120600937f664129eddb000ca70dc67279b69ce7d0678ae236ba5e86439ce7", "currentRequestSchemaSha256": "b3120600937f664129eddb000ca70dc67279b69ce7d0678ae236ba5e86439ce7", - "newRequestProperties": [ - "body", - "datasetId" - ], + "newRequestProperties": [], "effect": "write", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_datasets.upsert_rows", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_datasets.upsert_rows", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/resources/datasets/{datasetId}/rows", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update up to 100 dataset rows using the authenticated operator's actual organization authority. Set deleteMissing explicitly; true removes existing rows omitted from this selected update. The separate ingestion API-key contract remains unchanged." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -6713,29 +5461,32 @@ "description": "Update up to 100 dataset rows using the authenticated operator's actual organization authority. Set deleteMissing explicitly; true removes existing rows omitted from this selected update. The separate ingestion API-key contract remains unchanged." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "cc05e509a40df5d7ecd7ba739b9a7ca8186b2ebc5649c82d9e1b0eae7294fc6d", "currentRequestSchemaSha256": "cc05e509a40df5d7ecd7ba739b9a7ca8186b2ebc5649c82d9e1b0eae7294fc6d", - "newRequestProperties": [ - "body", - "datasetId" - ], + "newRequestProperties": [], "effect": "write", "authority": "DataManagementAccess and dataset organization scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.archive", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.archive", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/archive", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Archive a mailbox using its current version and explicit confirmation. This changes organization routing through the same canonical transaction used by the UI." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -6746,29 +5497,32 @@ "description": "Archive a mailbox using its current version and explicit confirmation. This changes organization routing through the same canonical transaction used by the UI." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "87433b39140a712152fe4f47823d4d424257cd5f71eaa63ea85a75dcdc833ad9", "currentRequestSchemaSha256": "87433b39140a712152fe4f47823d4d424257cd5f71eaa63ea85a75dcdc833ad9", - "newRequestProperties": [ - "body", - "mailboxId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.create", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.create", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a mailbox with explicitly supplied write-only credentials. Credential values never appear in the preview or normal readback; create does not import mail implicitly." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -6779,28 +5533,32 @@ "description": "Create a mailbox with explicitly supplied write-only credentials. Credential values never appear in the preview or normal readback; create does not import mail implicitly." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "3a08535b53e6b39bda26b731d77cf42babbb8439c60c644745f36d0811737c84", "currentRequestSchemaSha256": "3a08535b53e6b39bda26b731d77cf42babbb8439c60c644745f36d0811737c84", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.create_layout", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.create_layout", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-layouts/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a custom email layout with canonical HTML sanitization." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -6811,100 +5569,140 @@ "description": "Create a custom email layout with canonical HTML sanitization." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "6a696bb8c84e994aed970df13acb6160cd4720c8bf7d04da1b9ec1cf85af2847", "currentRequestSchemaSha256": "6a696bb8c84e994aed970df13acb6160cd4720c8bf7d04da1b9ec1cf85af2847", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], + "effect": "write", + "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", + "boundedIntegrationCredential": { + "support": "denied_by_policy", + "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." + }, + "campaignOutcome": "requires_fresh_beta11_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.create_rule", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.create_rule", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a typed inbound mail rule, including authorized forwarded-sender processing; configured tenant/mailbox checks remain enforced." + }, + "currentContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a typed inbound mail rule, including authorized forwarded-sender processing; configured tenant/mailbox checks remain enforced." + }, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "2e37c00c71d0c0cc8a94fb745c1e77230b586f781e7ada6e168910714d8bbe0e", + "currentRequestSchemaSha256": "2e37c00c71d0c0cc8a94fb745c1e77230b586f781e7ada6e168910714d8bbe0e", + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" - }, - { - "operationKey": "helpdesk_email_settings.create_rule", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "campaignOutcome": "requires_fresh_beta11_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.create_template", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.create_template", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-templates/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a custom email template using the canonical HTML sanitizer." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", - "pathTemplate": "/api/v1/inbound-email-rules/", + "pathTemplate": "/api/v1/email-templates/", "effect": "write", "readOnly": false, "confirmationRequired": true, - "description": "Create a typed inbound mail rule, including authorized forwarded-sender processing; configured tenant/mailbox checks remain enforced." + "description": "Create a custom email template using the canonical HTML sanitizer." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, - "currentRequestSchemaSha256": "2e37c00c71d0c0cc8a94fb745c1e77230b586f781e7ada6e168910714d8bbe0e", - "newRequestProperties": [ - "body" - ], + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "04131e4ce9e7ecf1cb69bff621169f9ee983292802498f50b3fba2fa32147424", + "currentRequestSchemaSha256": "04131e4ce9e7ecf1cb69bff621169f9ee983292802498f50b3fba2fa32147424", + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { - "operationKey": "helpdesk_email_settings.create_template", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "operationKey": "helpdesk_email_settings.delete_layout", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.delete_layout", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/email-layouts/{layoutId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one custom layout; protected system layouts remain undeletable." + }, "currentContract": { "requestContract": "OperatorRequest", - "method": "POST", - "pathTemplate": "/api/v1/email-templates/", + "method": "DELETE", + "pathTemplate": "/api/v1/email-layouts/{layoutId}", "effect": "write", "readOnly": false, "confirmationRequired": true, - "description": "Create a custom email template using the canonical HTML sanitizer." + "description": "Delete one custom layout; protected system layouts remain undeletable." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, - "currentRequestSchemaSha256": "04131e4ce9e7ecf1cb69bff621169f9ee983292802498f50b3fba2fa32147424", - "newRequestProperties": [ - "body" - ], + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d5fedca1802d8965256f37d9b1647955b5ba806302d5a26a8b5defe76f1766e6", + "currentRequestSchemaSha256": "d5fedca1802d8965256f37d9b1647955b5ba806302d5a26a8b5defe76f1766e6", + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { - "operationKey": "helpdesk_email_settings.delete_layout", + "operationKey": "helpdesk_email_settings.delete_rule", "catalogStatus": "added", "baselineOperationKey": null, "baselineContract": null, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", - "pathTemplate": "/api/v1/email-layouts/{layoutId}", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}", "effect": "write", "readOnly": false, "confirmationRequired": true, - "description": "Delete one custom layout; protected system layouts remain undeletable." + "description": "Delete one explicitly selected inbound rule while preserving its message processing audit history. Already started message work is not cancelled or replayed." }, "changes": {}, "requestSchemaChanged": true, @@ -6912,9 +5710,9 @@ "/" ], "baselineRequestSchemaSha256": null, - "currentRequestSchemaSha256": "d5fedca1802d8965256f37d9b1647955b5ba806302d5a26a8b5defe76f1766e6", + "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", "newRequestProperties": [ - "layoutId" + "ruleId" ], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", @@ -6922,13 +5720,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.delete_template", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.delete_template", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/email-templates/{templateId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete a custom template; protected system templates remain undeletable." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -6939,28 +5745,32 @@ "description": "Delete a custom template; protected system templates remain undeletable." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "90a7a83b9255e18243e1bc92c9dc5f2c44327c31fc0c7d8b29255284f31f24de", "currentRequestSchemaSha256": "90a7a83b9255e18243e1bc92c9dc5f2c44327c31fc0c7d8b29255284f31f24de", - "newRequestProperties": [ - "templateId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.diagnostics", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.diagnostics", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/diagnostics", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read bounded mailbox receipt, cursor and worker diagnostics without secrets." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -6971,28 +5781,32 @@ "description": "Read bounded mailbox receipt, cursor and worker diagnostics without secrets." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", - "newRequestProperties": [ - "mailboxId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.disable", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.disable", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/disable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Disable one saved mailbox without deleting its history or credentials." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7003,28 +5817,32 @@ "description": "Disable one saved mailbox without deleting its history or credentials." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", - "newRequestProperties": [ - "mailboxId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.disable_rule", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.disable_rule", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}/disable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Disable one inbound rule while retaining its audit history." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7035,28 +5853,32 @@ "description": "Disable one inbound rule while retaining its audit history." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", - "newRequestProperties": [ - "ruleId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.effective", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.effective", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/effective", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read each organization's effective dedicated or inherited mailbox route." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -7069,7 +5891,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -7078,13 +5900,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.enable", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.enable", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/enable", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable one saved mailbox through its canonical readiness and credential checks." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7095,28 +5925,32 @@ "description": "Enable one saved mailbox through its canonical readiness and credential checks." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", - "newRequestProperties": [ - "mailboxId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.enable_rule", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.enable_rule", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}/enable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable one inbound rule after canonical binding validation." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7127,28 +5961,32 @@ "description": "Enable one inbound rule after canonical binding validation." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", - "newRequestProperties": [ - "ruleId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.get", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.get", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/{mailboxId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one saved mailbox configuration and its concurrency version." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -7159,28 +5997,32 @@ "description": "Read one saved mailbox configuration and its concurrency version." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", - "newRequestProperties": [ - "mailboxId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" - }, - { - "operationKey": "helpdesk_email_settings.get_rule", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "campaignOutcome": "requires_fresh_beta11_operator_evidence" + }, + { + "operationKey": "helpdesk_email_settings.get_rule", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.get_rule", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read an inbound email rule including its typed conditions and actions." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -7191,28 +6033,32 @@ "description": "Read an inbound email rule including its typed conditions and actions." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", "currentRequestSchemaSha256": "42d5d94072a4b5f7e6872f650233c0d926a04df693c891435d6b8611810ebd5c", - "newRequestProperties": [ - "ruleId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.historical_import", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.historical_import", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/historical/import", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Queue only the explicitly confirmed historical receipt selection. Import eligibility, duplicates and mailbox state remain server-validated." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7223,29 +6069,32 @@ "description": "Queue only the explicitly confirmed historical receipt selection. Import eligibility, duplicates and mailbox state remain server-validated." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "386db33f41d0aac823715310a0c6b342fc3cb7f449f456f07eae41681156e3c7", "currentRequestSchemaSha256": "386db33f41d0aac823715310a0c6b342fc3cb7f449f456f07eae41681156e3c7", - "newRequestProperties": [ - "body", - "mailboxId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.historical_preview", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.historical_preview", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/historical/preview", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Inspect 1–50 eligible historical mailbox messages without importing them; retain the returned receipt identities for a selected import." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7256,29 +6105,32 @@ "description": "Inspect 1–50 eligible historical mailbox messages without importing them; retain the returned receipt identities for a selected import." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d76167947d229bd74f5c3f156cb99149cce13092d1c969983b15ca3899b050ca", "currentRequestSchemaSha256": "d76167947d229bd74f5c3f156cb99149cce13092d1c969983b15ca3899b050ca", - "newRequestProperties": [ - "body", - "mailboxId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.layout_choices", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.layout_choices", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-layouts/choices", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read selectable system and current-tenant email layouts." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -7291,7 +6143,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -7300,13 +6152,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.layouts", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.layouts", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-layouts/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved email layouts, optionally scoped to an integer tenant ID." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -7317,28 +6177,32 @@ "description": "Read saved email layouts, optionally scoped to an integer tenant ID." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "099c62e8951860a29d7e9ef2f4f36108a5d0cc1881ea22cde8df7a9c5635fe76", "currentRequestSchemaSha256": "099c62e8951860a29d7e9ef2f4f36108a5d0cc1881ea22cde8df7a9c5635fe76", - "newRequestProperties": [ - "tenantId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.list", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.list", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved mailbox settings with stored secrets redacted by the API." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -7351,7 +6215,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -7360,13 +6224,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.outgoing", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.outgoing", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the mailbox's outgoing sender configuration and version with credentials redacted." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -7377,28 +6249,32 @@ "description": "Read the mailbox's outgoing sender configuration and version with credentials redacted." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", - "newRequestProperties": [ - "mailboxId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.preview_template", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.preview_template", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-templates/preview", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Render a saved or draft email template using a selected tenant's branding without sending a message." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7409,28 +6285,32 @@ "description": "Render a saved or draft email template using a selected tenant's branding without sending a message." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e4cb13626aa6cb9bb07c1deed0e914b1d2e5f7cbdaab5a82b9ba1a60834baccf", "currentRequestSchemaSha256": "e4cb13626aa6cb9bb07c1deed0e914b1d2e5f7cbdaab5a82b9ba1a60834baccf", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.reorder_rules", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.reorder_rules", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/inbound-email-rules/reorder", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Reorder an explicitly selected distinct set of rules in one tenant/mailbox scope." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7441,28 +6321,32 @@ "description": "Reorder an explicitly selected distinct set of rules in one tenant/mailbox scope." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "6bccd032016ada4c9f0c96cdeadeda2e1a3fa55bbb9156f209d8ad5ec5a69ee5", "currentRequestSchemaSha256": "6bccd032016ada4c9f0c96cdeadeda2e1a3fa55bbb9156f209d8ad5ec5a69ee5", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.retry_receipt", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.retry_receipt", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/receipts/{receiptId}/retry", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Queue retry of one eligible inbound receipt. The server checks outcome eligibility and concurrent changes." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7473,29 +6357,32 @@ "description": "Queue retry of one eligible inbound receipt. The server checks outcome eligibility and concurrent changes." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "5786b3dd195ffc67377adef45d3de23ec9ec77441f66c132f752f9d9eb71163f", "currentRequestSchemaSha256": "5786b3dd195ffc67377adef45d3de23ec9ec77441f66c132f752f9d9eb71163f", - "newRequestProperties": [ - "mailboxId", - "receiptId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.rule_audit", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.rule_audit", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/inbound-email-rules/audit", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read up to 200 inbound rule processing outcomes filtered by ticket, message, tenant or mailbox." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -7506,31 +6393,32 @@ "description": "Read up to 200 inbound rule processing outcomes filtered by ticket, message, tenant or mailbox." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "198711e71b95287926112135ef9c985cde9185ca77c352fd88d3deb2340b1054", "currentRequestSchemaSha256": "198711e71b95287926112135ef9c985cde9185ca77c352fd88d3deb2340b1054", - "newRequestProperties": [ - "mailboxId", - "messageId", - "tenantId", - "ticketId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.rules", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.rules", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/inbound-email-rules/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List inbound routing rules for a tenant and/or mailbox." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -7541,29 +6429,32 @@ "description": "List inbound routing rules for a tenant and/or mailbox." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, - "currentRequestSchemaSha256": "259284401dc6ef0624e3d3bfd99a967f4742e8e588437adbe7e8b84ccfdb13cb", - "newRequestProperties": [ - "mailboxId", - "tenantId" - ], + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "259284401dc6ef0624e3d3bfd99a967f4742e8e588437adbe7e8b84ccfdb13cb", + "currentRequestSchemaSha256": "259284401dc6ef0624e3d3bfd99a967f4742e8e588437adbe7e8b84ccfdb13cb", + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.save_outgoing", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.save_outgoing", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Save complete outgoing sender configuration with optimistic concurrency. Supply smtpPassword as an empty string to retain its saved value, a new write-only value to rotate it, or clearSmtpPassword=true to remove it." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -7574,29 +6465,32 @@ "description": "Save complete outgoing sender configuration with optimistic concurrency. Supply smtpPassword as an empty string to retain its saved value, a new write-only value to rotate it, or clearSmtpPassword=true to remove it." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "2cae3879d4dbead0d1c0759b99dfe4c05dfa754148fb5b837092224190c0afd2", "currentRequestSchemaSha256": "2cae3879d4dbead0d1c0759b99dfe4c05dfa754148fb5b837092224190c0afd2", - "newRequestProperties": [ - "body", - "mailboxId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.send_test", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.send_test", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing/send-test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Send one explicitly confirmed sample message to one recipient using the saved sender. Acceptance by the provider is reported separately from final delivery." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7607,29 +6501,32 @@ "description": "Send one explicitly confirmed sample message to one recipient using the saved sender. Acceptance by the provider is reported separately from final delivery." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "75882743e8e02a11893576507c1ba2a70dbb6d25c73d8a7fd40ae6859a11f517", "currentRequestSchemaSha256": "75882743e8e02a11893576507c1ba2a70dbb6d25c73d8a7fd40ae6859a11f517", - "newRequestProperties": [ - "body", - "mailboxId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.set_worker", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.set_worker", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/worker", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Persist an explicitly confirmed mailbox worker run/pause decision. Deployment-level disabled ingestion remains authoritative." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7640,28 +6537,32 @@ "description": "Persist an explicitly confirmed mailbox worker run/pause decision. Deployment-level disabled ingestion remains authoritative." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9bb0272371242ffc1451c90c80949a96e259f6760f2220243432ea1b5d8daf3e", "currentRequestSchemaSha256": "9bb0272371242ffc1451c90c80949a96e259f6760f2220243432ea1b5d8daf3e", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.sync", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.sync", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/sync", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Queue a sync of one configured mailbox and report queued versus unavailable state." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7672,28 +6573,32 @@ "description": "Queue a sync of one configured mailbox and report queued versus unavailable state." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", - "newRequestProperties": [ - "mailboxId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.templates", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.templates", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-templates/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved email templates." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -7706,7 +6611,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -7715,13 +6620,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.test_draft_mailbox", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.test_draft_mailbox", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test explicitly supplied draft mailbox settings and write-only credentials without saving the configuration or importing mail." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7732,28 +6645,32 @@ "description": "Test explicitly supplied draft mailbox settings and write-only credentials without saving the configuration or importing mail." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "3a08535b53e6b39bda26b731d77cf42babbb8439c60c644745f36d0811737c84", "currentRequestSchemaSha256": "3a08535b53e6b39bda26b731d77cf42babbb8439c60c644745f36d0811737c84", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.test_mailbox", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.test_mailbox", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test a saved inbound mailbox configuration and retain its test result against the saved revision." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7764,28 +6681,32 @@ "description": "Test a saved inbound mailbox configuration and retain its test result against the saved revision." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", - "newRequestProperties": [ - "mailboxId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.test_outgoing", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.test_outgoing", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-settings/{mailboxId}/outgoing/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test authentication of the saved outgoing transport and record the tested revision." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7796,28 +6717,32 @@ "description": "Test authentication of the saved outgoing transport and record the tested revision." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", "currentRequestSchemaSha256": "acf73cdfeed32308a1d5cf11fa35c68e02a30214e53501bbfb53c64e21a09bc4", - "newRequestProperties": [ - "mailboxId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.update", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.update", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-settings/{mailboxId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Save the complete mailbox configuration using the current version. Secret fields are write-only; omitted or empty values preserve saved secrets unless the corresponding clear flag is true." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -7828,29 +6753,32 @@ "description": "Save the complete mailbox configuration using the current version. Secret fields are write-only; omitted or empty values preserve saved secrets unless the corresponding clear flag is true." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ac705ca7c60bc1074b2d3c7770c633716a520b6ed19c5abdf2b83bb7e6d713f3", "currentRequestSchemaSha256": "ac705ca7c60bc1074b2d3c7770c633716a520b6ed19c5abdf2b83bb7e6d713f3", - "newRequestProperties": [ - "body", - "mailboxId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.update_layout", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.update_layout", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-layouts/{layoutId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update layout content while preserving identity and system protection." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -7861,29 +6789,32 @@ "description": "Update layout content while preserving identity and system protection." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "40969a874e07202431c87bbd6801794b3067a65fdab06fbd886005389aeb3324", "currentRequestSchemaSha256": "40969a874e07202431c87bbd6801794b3067a65fdab06fbd886005389aeb3324", - "newRequestProperties": [ - "body", - "layoutId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.update_rule", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.update_rule", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/inbound-email-rules/{ruleId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the typed settings of one inbound email rule." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -7894,29 +6825,32 @@ "description": "Replace the typed settings of one inbound email rule." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ea979a1a73deb014629beb2cc8aa7279e0d4b849194ef9c7aa210f17470ceafc", "currentRequestSchemaSha256": "ea979a1a73deb014629beb2cc8aa7279e0d4b849194ef9c7aa210f17470ceafc", - "newRequestProperties": [ - "body", - "ruleId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.update_template", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.update_template", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/email-templates/{templateId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update template content while the API preserves identity and increments its version." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -7927,29 +6861,32 @@ "description": "Update template content while the API preserves identity and increments its version." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "7f86b975c3aaa694535fd116c22f13138ef9473dfb4dda22d729efef8d5ed19b", "currentRequestSchemaSha256": "7f86b975c3aaa694535fd116c22f13138ef9473dfb4dda22d729efef8d5ed19b", - "newRequestProperties": [ - "body", - "templateId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.upload_template_image", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.upload_template_image", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email-templates/{templateName}/images", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Upload one inline template image, at most 1 MiB, through the authenticated multipart endpoint and return its stored image URL." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -7960,29 +6897,32 @@ "description": "Upload one inline template image, at most 1 MiB, through the authenticated multipart endpoint and return its stored image URL." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d63f76add2f83ac2653fec60c6989f102fb4c58675ec31b8754b8fe7f16522c8", "currentRequestSchemaSha256": "d63f76add2f83ac2653fec60c6989f102fb4c58675ec31b8754b8fe7f16522c8", - "newRequestProperties": [ - "body", - "templateName" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_email_settings.worker_status", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_email_settings.worker_status", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/email-settings/worker", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the persisted instance mailbox worker decision and deployment-level ingestion status." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -7995,7 +6935,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -8004,7 +6944,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_enums.change_lifecycle_state", @@ -8028,21 +6968,7 @@ "confirmationRequired": false, "description": "Read enum metadata." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -8054,7 +6980,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_enums.list", @@ -8078,21 +7004,7 @@ "confirmationRequired": false, "description": "Read enum metadata." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -8104,7 +7016,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_enums.request_task_status", @@ -8128,21 +7040,7 @@ "confirmationRequired": false, "description": "Read enum metadata." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -8154,7 +7052,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_enums.ticket_priority", @@ -8178,21 +7076,7 @@ "confirmationRequired": false, "description": "Read enum metadata." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -8204,7 +7088,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_enums.ticket_state", @@ -8228,21 +7112,7 @@ "confirmationRequired": false, "description": "Read enum metadata." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -8254,7 +7124,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_examples.list", @@ -8278,21 +7148,7 @@ "confirmationRequired": false, "description": "Read operator examples." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -8304,7 +7160,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_health.get", @@ -8328,21 +7184,7 @@ "confirmationRequired": false, "description": "Read live, ready, and authenticated health." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -8354,7 +7196,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.add_worklog", @@ -8378,21 +7220,7 @@ "confirmationRequired": true, "description": "add_worklog incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "1a495b580311ffc63dba33cc47b239316762e5d83e21bb57dd90a74a87c4f672", @@ -8404,7 +7232,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.assign", @@ -8428,21 +7256,7 @@ "confirmationRequired": true, "description": "assign incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "d9a7a076c4270fd4f691aa95fb149cefa06159991723376e2639544843cac37b", @@ -8454,7 +7268,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.assign_self", @@ -8478,21 +7292,7 @@ "confirmationRequired": true, "description": "assign_self incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "3000a32784ac81322d04755acc66a6ccb883e342b29a136ba1aa71d98edda7bb", @@ -8504,7 +7304,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.attachments_count", @@ -8528,21 +7328,7 @@ "confirmationRequired": false, "description": "Read attachments_count for one incident." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "7240994ac58ed328fb71d3aa6f64c81332edf14601b873e4336316cb2d3d526e", @@ -8554,7 +7340,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.bulk_create", @@ -8578,21 +7364,7 @@ "confirmationRequired": true, "description": "bulk_create incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "dc7bd7a018498fefb6733ce84c1872459ffd75a160086cf2045ee2d4ab5d1b11", @@ -8604,13 +7376,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.bulk_delete", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.bulk_delete", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/delete", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Permanently delete 1–100 explicitly selected incidents through the canonical silent deletion action. Requesters are not notified. Check deleted and missing counts and read back the selected IDs before repeating an uncertain batch." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -8621,28 +7401,32 @@ "description": "Permanently delete 1–100 explicitly selected incidents through the canonical silent deletion action. Requesters are not notified. Check deleted and missing counts and read back the selected IDs before repeating an uncertain batch." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0a5726c2d6501ea724286c0cc73699fcff736c2ba235f89576bfc142eab4725b", "currentRequestSchemaSha256": "0a5726c2d6501ea724286c0cc73699fcff736c2ba235f89576bfc142eab4725b", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "Incident deletion authority for every selected incident; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.bulk_marketing_spam", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.bulk_marketing_spam", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/bulk/marketing-spam", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Silently resolve 1–100 explicitly selected incidents, complete their SLA, and exclude them from requester outbound email as marketing or spam. Check updated and missing counts and read back the selected incidents." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -8653,22 +7437,18 @@ "description": "Silently resolve 1–100 explicitly selected incidents, complete their SLA, and exclude them from requester outbound email as marketing or spam. Check updated and missing counts and read back the selected incidents." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0a5726c2d6501ea724286c0cc73699fcff736c2ba235f89576bfc142eab4725b", "currentRequestSchemaSha256": "0a5726c2d6501ea724286c0cc73699fcff736c2ba235f89576bfc142eab4725b", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "Incident.Manager for every selected incident or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.bulk_state", @@ -8692,21 +7472,7 @@ "confirmationRequired": true, "description": "bulk_state incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "96fba8395ba5f1f1e06c502db786cf9207c334a5b8e31fc74d12935f00f44892", @@ -8718,7 +7484,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.close", @@ -8742,21 +7508,7 @@ "confirmationRequired": true, "description": "close incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "093825c1798d368403227679872767a49bab77189d391f23f56b0e7e2c9ef3e5", @@ -8768,7 +7520,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.create", @@ -8792,21 +7544,7 @@ "confirmationRequired": true, "description": "create incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "40823a916ac65a0412463c4affce326b78f1f1a7944028d8416222a7e33d3fb0", @@ -8818,13 +7556,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.create_relation", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.create_relation", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/incidents/{incidentId}/relations", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Link two incidents in the same organization and copy source listeners to the target. relationType 0 means DuplicateOf and always resolves the source; 1 means RelatedTo and follows the explicit closeSourceTicket choice. Closing completes the source SLA and publishes the canonical event. Read both incidents and relations after an uncertain result before another attempt; an existing identical relation returns 409." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -8835,23 +7581,18 @@ "description": "Link two incidents in the same organization and copy source listeners to the target. relationType 0 means DuplicateOf and always resolves the source; 1 means RelatedTo and follows the explicit closeSourceTicket choice. Closing completes the source SLA and publishes the canonical event. Read both incidents and relations after an uncertain result before another attempt; an existing identical relation returns 409." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "f76e4512ff535599fdf57eff72124158fcd216d6fb8bb615fd345da3bab34b24", "currentRequestSchemaSha256": "f76e4512ff535599fdf57eff72124158fcd216d6fb8bb615fd345da3bab34b24", - "newRequestProperties": [ - "body", - "incidentId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "Incident.Manager in both incident organizations or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.delete", @@ -8875,21 +7616,7 @@ "confirmationRequired": true, "description": "delete incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "d0f9bfcb1984178e4f6df525891b0cfde826ab480a263634af40a94ff4cb2075", @@ -8901,13 +7628,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.delete_relation", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.delete_relation", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/incidents/{incidentId}/relations/{relationId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Remove the selected relationship after reading its UUID. This removes only the link; it does not reopen the source or remove listeners already copied to the target." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -8918,23 +7653,18 @@ "description": "Remove the selected relationship after reading its UUID. This removes only the link; it does not reopen the source or remove listeners already copied to the target." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c8fa7fe4a04d24453839d3e527e70affefeb32917c389154acccaf9304fac47d", "currentRequestSchemaSha256": "c8fa7fe4a04d24453839d3e527e70affefeb32917c389154acccaf9304fac47d", - "newRequestProperties": [ - "incidentId", - "relationId" - ], + "newRequestProperties": [], "effect": "write", "authority": "Incident.Manager for both related incidents or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.get", @@ -8958,21 +7688,7 @@ "confirmationRequired": false, "description": "get incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "9195222a85256812bfcfce974a33b4c89dd8f0482982911d60a6170a1d8845a2", @@ -8984,7 +7700,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.list", @@ -9008,21 +7724,7 @@ "confirmationRequired": false, "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "586f9bd0782de3a389f2012209c96123ce1aca093afc151122f8bf8ef56d6dcd", @@ -9034,7 +7736,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.listeners_count", @@ -9058,21 +7760,7 @@ "confirmationRequired": false, "description": "Read listeners_count for one incident." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "e32a19546b402223e72fc5f9dc4d4afbec79bcc49dfb65ba807b9529e4f97aaa", @@ -9084,7 +7772,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.peek", @@ -9108,30 +7796,7 @@ "confirmationRequired": false, "description": "peek incidents." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "ec302a1a46fa69dc368028d798b57bd308a758b3e178f92e7fcf2ef7855d3d57", @@ -9143,13 +7808,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.relations", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_incidents.relations", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/relations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the current incident's duplicate and related links. Links to incidents outside the caller's visibility are excluded." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -9160,22 +7833,18 @@ "description": "Read the current incident's duplicate and related links. Links to incidents outside the caller's visibility are excluded." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "5aa90f282e330d4f89c878c47ba5549a401e6da824ca4e66e6914877bb367ea8", "currentRequestSchemaSha256": "5aa90f282e330d4f89c878c47ba5549a401e6da824ca4e66e6914877bb367ea8", - "newRequestProperties": [ - "incidentId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Visibility of both related incidents; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.state", @@ -9199,21 +7868,7 @@ "confirmationRequired": true, "description": "state incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "14c0a7906b404636b8a94c230c7451ea3f6dc234842bf8dfc5fb58affd8cdfd2", @@ -9225,7 +7880,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.timeline", @@ -9249,21 +7904,7 @@ "confirmationRequired": false, "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "3f4c9c7ca50e80dd99f6ed82f93212ad9f6024ae8ff9ddacfdc2bff5d3c3f5cf", @@ -9275,7 +7916,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.timeline_count", @@ -9299,21 +7940,7 @@ "confirmationRequired": false, "description": "Read timeline_count for one incident." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "51d726a2db4b6fda3073a0562c3f580db364219286cccccc57a523e672b6bbcd", @@ -9325,7 +7952,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_incidents.update", @@ -9349,21 +7976,7 @@ "confirmationRequired": true, "description": "update incidents." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "e7a985caa08e8b6586861279c0ab558cee2b7d60ac532e14560293139197cbde", @@ -9375,7 +7988,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_logs.search", @@ -9399,44 +8012,7 @@ "confirmationRequired": false, "description": "Run a bounded, redacted log search." }, - "changes": { - "authority": { - "old": "Exact AuthentikAiAgent authentication scheme; ordinary integration/gateway identities are denied by policy regardless of scoped grants", - "new": "Exact AuthentikAiAgent scheme or explicit current administrator mcp-owner grant; ordinary scoped integration/gateway identities are denied regardless of scoped grants" - }, - "boundedIntegrationCredential": { - "old": { - "support": "denied_by_policy", - "reason": "The exact AuthentikAiAgent API authentication scheme is required. Ordinary integration credentials and gateway execution tokens cannot satisfy it, regardless of scoped grants. Explicit external Authentik downstream identity is supported; never switch modes as fallback." - }, - "new": { - "support": "denied_by_policy", - "reason": "Ordinary scoped credentials cannot satisfy agent-operation authority. An explicitly approved mcp-owner grant or the exact external AuthentikAiAgent scheme is required; invocation and ticket binding remain authoritative." - } - }, - "credentialModes": { - "old": [ - "explicit external Authentik downstream identity satisfying exact AuthentikAiAgent scheme" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik downstream identity satisfying exact AuthentikAiAgent scheme" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "350c9565e3dbc778fcc185e8298b237aa5edc86705aaebe042d50e03ffdf94c9", @@ -9448,13 +8024,21 @@ "support": "denied_by_policy", "reason": "Ordinary scoped credentials cannot satisfy agent-operation authority. An explicitly approved mcp-owner grant or the exact external AuthentikAiAgent scheme is required; invocation and ticket binding remain authoritative." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.changed_route_preview", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.changed_route_preview", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/{deliveryId}/changed-route-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the old and current sender routes and all revisions before approving a route change." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -9465,28 +8049,32 @@ "description": "Read the old and current sender routes and all revisions before approving a route change." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", "currentRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", - "newRequestProperties": [ - "deliveryId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.failed", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.failed", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/timeline/failed", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read up to 100 failed delivery events including retry eligibility and recipient outcome evidence." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -9499,7 +8087,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -9508,13 +8096,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.outgoing_retry_preview", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.outgoing_retry_preview", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/{deliveryId}/outgoing-retry-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the current outgoing revision and fence required before retrying a reviewed sender configuration." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -9525,28 +8121,32 @@ "description": "Read the current outgoing revision and fence required before retrying a reviewed sender configuration." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", "currentRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", - "newRequestProperties": [ - "deliveryId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.pending", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.pending", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/pending", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Search pending deliveries with bounded paging, status, recipient and organization filters. Delivery state is distinct from queue acceptance." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -9557,39 +8157,32 @@ "description": "Search pending deliveries with bounded paging, status, recipient and organization filters. Delivery state is distinct from queue acceptance." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "652a87b375ac5295fdba4e89cdf840af5d54509d526639656917bf245ee4cdc3", "currentRequestSchemaSha256": "652a87b375ac5295fdba4e89cdf840af5d54509d526639656917bf245ee4cdc3", - "newRequestProperties": [ - "descending", - "from", - "organizationId", - "page", - "pageSize", - "reason", - "recipient", - "search", - "sender", - "sort", - "status", - "to" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.pending_actions", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.pending_actions", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/pending/actions", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Apply retry, cancel or remove to 1–100 explicitly selected delivery IDs with a recorded reason. The API reauthorizes and reports each result independently." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -9600,28 +8193,32 @@ "description": "Apply retry, cancel or remove to 1–100 explicitly selected delivery IDs with a recorded reason. The API reauthorizes and reports each result independently." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ef19fd59602be26f8f27d0a7839106552f6bb1e3285b4cdc2f0d1098fd19e5ad", "currentRequestSchemaSha256": "ef19fd59602be26f8f27d0a7839106552f6bb1e3285b4cdc2f0d1098fd19e5ad", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.pending_count", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.pending_count", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/timeline/pending-count", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the number of failed deliveries awaiting review or retry." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -9634,7 +8231,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -9643,13 +8240,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.pending_organizations", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.pending_organizations", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/pending/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Look up organizations for pending-delivery filtering; returns at most 50 matches." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -9660,30 +8265,32 @@ "description": "Look up organizations for pending-delivery filtering; returns at most 50 matches." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "58a948cb667ccb66efd9906d31b3557fc22d5e3490e1b213f4ec8d13c4aeb6d3", "currentRequestSchemaSha256": "58a948cb667ccb66efd9906d31b3557fc22d5e3490e1b213f4ec8d13c4aeb6d3", - "newRequestProperties": [ - "id", - "q", - "take" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.retry", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.retry", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Retry one eligible failed delivery. Uncertain, partially accepted or changed-sender deliveries require their separate reviewed retry operation." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -9694,28 +8301,32 @@ "description": "Retry one eligible failed delivery. Uncertain, partially accepted or changed-sender deliveries require their separate reviewed retry operation." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", "currentRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", - "newRequestProperties": [ - "deliveryId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.retry_confirmed_undelivered", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.retry_confirmed_undelivered", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry-confirmed-undelivered", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Retry an uncertain delivery only after independent evidence confirms no delivery. The API retains evidence, outcome and fence checks." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -9726,29 +8337,32 @@ "description": "Retry an uncertain delivery only after independent evidence confirms no delivery. The API retains evidence, outcome and fence checks." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "806c1b237df5d50e7e6cc374244f0138e3e02e2b9b429b37afda0b11d5e48f6f", "currentRequestSchemaSha256": "806c1b237df5d50e7e6cc374244f0138e3e02e2b9b429b37afda0b11d5e48f6f", - "newRequestProperties": [ - "body", - "deliveryId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.retry_current_outgoing", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.retry_current_outgoing", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry-current-outgoing", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Retry using the reviewed outgoing configuration with its expected revisions and fence. Preserve the preview values in the request." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -9759,29 +8373,32 @@ "description": "Retry using the reviewed outgoing configuration with its expected revisions and fence. Preserve the preview values in the request." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4acc1655933e6bc7a5dba670109f84e38daf6300e333a52397e19e9d1c0068e0", "currentRequestSchemaSha256": "4acc1655933e6bc7a5dba670109f84e38daf6300e333a52397e19e9d1c0068e0", - "newRequestProperties": [ - "body", - "deliveryId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.retry_current_route", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.retry_current_route", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/timeline/{deliveryId}/retry-current-route", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Retry with an explicitly reviewed new sender using the exact route-preview identifiers and revisions." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -9792,29 +8409,32 @@ "description": "Retry with an explicitly reviewed new sender using the exact route-preview identifiers and revisions." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "30ef4807b7bf87441f8e78137857ab6290ea29281f460284dbce7e02a9a85390", "currentRequestSchemaSha256": "30ef4807b7bf87441f8e78137857ab6290ea29281f460284dbce7e02a9a85390", - "newRequestProperties": [ - "body", - "deliveryId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.send", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.send", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/email/send", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Send an administrator-authored message through the configured mail service to explicitly supplied recipients. For ticket replies use the ticket add_worklog operation with isInternalNote=false." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -9825,28 +8445,32 @@ "description": "Send an administrator-authored message through the configured mail service to explicitly supplied recipients. For ticket replies use the ticket add_worklog operation with isInternalNote=false." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8f6e346478b8c8aae64cc088174f70b9cb9dc8fd3734736b37c8b17b98c47d8a", "currentRequestSchemaSha256": "8f6e346478b8c8aae64cc088174f70b9cb9dc8fd3734736b37c8b17b98c47d8a", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.test_provider", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.test_provider", + "baselineContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/email/test", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Test availability of the configured email provider." + }, "currentContract": { "requestContract": "None", "method": "POST", @@ -9859,7 +8483,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "external_io", @@ -9868,13 +8492,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_mail.uncertain_retry_preview", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_mail.uncertain_retry_preview", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/timeline/{deliveryId}/uncertain-retry-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read an uncertain delivery's current fence, sender and recipients before independently establishing whether delivery occurred." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -9884,29 +8516,33 @@ "confirmationRequired": false, "description": "Read an uncertain delivery's current fence, sender and recipients before independently establishing whether delivery occurred." }, - "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "changes": {}, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", "currentRequestSchemaSha256": "e18e54a6b48309fac33da1c7d4d49285b80e043b65607fcbc5a4d7b28d744781", - "newRequestProperties": [ - "deliveryId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_notifications.error_summary", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_notifications.error_summary", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/notifications/error-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the caller's authorized error notification counters." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -9919,7 +8555,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -9928,7 +8564,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_notifications.get", @@ -9952,21 +8588,7 @@ "confirmationRequired": false, "description": "get operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "9625d149e0ff898eb9a81992ba476e29721fd07b9d29a0d6586560cb4ac3e45f", @@ -9978,7 +8600,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_notifications.list", @@ -10002,21 +8624,7 @@ "confirmationRequired": false, "description": "list operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "417baa9d661cac4419720b0ee7982d7c29282403c68109c777e174940f0bd46a", @@ -10028,7 +8636,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_notifications.mark_read", @@ -10052,21 +8660,7 @@ "confirmationRequired": true, "description": "mark_read operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "7e4dc2e9f1c672d8e8c4918ccf16ff14660d2f78ebb47a7f65008994f0d52f46", @@ -10078,7 +8672,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_notifications.summary", @@ -10102,21 +8696,7 @@ "confirmationRequired": false, "description": "Read total, unread and unread Error/Critical counts for the actor's complete authorized notification population." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -10128,13 +8708,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_notifications.timeline", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_notifications.timeline", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/timeline", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read persisted DomainEvent notifications for a reference, correlationId or both, with bounded output. At least one selector must contain non-whitespace text." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -10145,31 +8733,32 @@ "description": "Read persisted DomainEvent notifications for a reference, correlationId or both, with bounded output. At least one selector must contain non-whitespace text." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "e90b1b807225ecbb8c4122d1572b8e31b09bc89bafc938b04ad69706c5fea775", "currentRequestSchemaSha256": "e90b1b807225ecbb8c4122d1572b8e31b09bc89bafc938b04ad69706c5fea775", - "newRequestProperties": [ - "correlationId", - "reference", - "take", - "tenantId" - ], + "newRequestProperties": [], "effect": "read", "authority": "NotificationAccess and current recipient/organization visibility; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_notifications.unread", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_notifications.unread", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/notifications/unread", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one bounded page of the caller's unread notifications." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -10180,23 +8769,18 @@ "description": "Read one bounded page of the caller's unread notifications." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "b7182b9fa08fc69c4630be95280a4a83d84189fc52a5d5926e364223bb8fe478", "currentRequestSchemaSha256": "b7182b9fa08fc69c4630be95280a4a83d84189fc52a5d5926e364223bb8fe478", - "newRequestProperties": [ - "page", - "pageSize" - ], + "newRequestProperties": [], "effect": "read", "authority": "NotificationAccess and current recipient visibility; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_notifications.unread_errors", @@ -10220,21 +8804,7 @@ "confirmationRequired": false, "description": "unread_errors operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "94b63698f157a56b423f74788905dd7fff847a1b59572ab9aa847ac172720c0a", @@ -10246,7 +8816,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_organizations.change_participants", @@ -10270,30 +8840,7 @@ "confirmationRequired": false, "description": "change_participants operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "a63d3675183c1a3fce84f7f85b9310ad1e009828400ec55944a424084f83f801", @@ -10305,7 +8852,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_organizations.get", @@ -10329,30 +8876,7 @@ "confirmationRequired": false, "description": "get operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "a3f8bc675fa2d5f75f53ebf339340b95ef97db6ffa96edb85856daf21949fdb2", @@ -10364,7 +8888,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_organizations.list", @@ -10388,30 +8912,7 @@ "confirmationRequired": false, "description": "list operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "065ad959abe31168726d802c6565ac3e588d38efcbc5a9cbf0c5d01611410089", @@ -10423,7 +8924,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_organizations.tenant_lookup", @@ -10447,30 +8948,7 @@ "confirmationRequired": false, "description": "tenant_lookup operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -10482,7 +8960,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_organizations.tenants", @@ -10506,30 +8984,7 @@ "confirmationRequired": false, "description": "tenants operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -10541,7 +8996,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_raw.get_change", @@ -10565,21 +9020,7 @@ "confirmationRequired": false, "description": "get_change operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "0a569045ad1e887192d1398bab406e258e92860c4d72c121e47044bba775e0e0", @@ -10591,7 +9032,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_raw.get_incident", @@ -10615,21 +9056,7 @@ "confirmationRequired": false, "description": "get_incident operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "c025db9186f501c37744079b020c661e56ddf9af968f7b41562e8f3ae7fbaeaa", @@ -10641,7 +9068,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_raw.get_request", @@ -10665,21 +9092,7 @@ "confirmationRequired": false, "description": "get_request operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "db51678e530cc9136b0115b19cfc735bcb7994a5de57437f808c688061a346ad", @@ -10691,7 +9104,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_raw.system_version", @@ -10715,21 +9128,7 @@ "confirmationRequired": false, "description": "system_version operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -10741,7 +9140,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_forms.by_service", @@ -10765,30 +9164,7 @@ "confirmationRequired": false, "description": "List forms for a service." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "762ed0bd32f0800bcb92dd605429fcbf90d66ce684f9af30b10377e2fbe3bcba", @@ -10800,7 +9176,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_forms.get", @@ -10824,21 +9200,7 @@ "confirmationRequired": false, "description": "Get one request form." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "7b8f566f27022fbca35c2550007193595bc362e6923e4bb4a4bf014dc66ff9d4", @@ -10850,7 +9212,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.bulk_complete", @@ -10874,25 +9236,7 @@ "confirmationRequired": true, "description": "bulk_complete operation." }, - "changes": { - "authority": { - "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", - "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "28f6484e23ef9e8be507cbd4cc96e6c68abcc3f389b7dcd301a2abb2e2913209", @@ -10904,7 +9248,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.bulk_retry", @@ -10928,25 +9272,7 @@ "confirmationRequired": true, "description": "bulk_retry operation." }, - "changes": { - "authority": { - "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", - "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "1682c4eedce82cb4387fdd19de579bad4f6b6fe95a0a276c0382ad8c4483a6cd", @@ -10958,7 +9284,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.bulk_start", @@ -10982,25 +9308,7 @@ "confirmationRequired": true, "description": "bulk_start operation." }, - "changes": { - "authority": { - "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", - "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "3d502712af9ff22895770ab820410e0ef9ae8b18b1e1bd02a257b74c63645009", @@ -11012,7 +9320,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.complete", @@ -11036,25 +9344,7 @@ "confirmationRequired": true, "description": "complete operation." }, - "changes": { - "authority": { - "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", - "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "2ea6877aeb3298ef6cb90d737e7781467e1cc6ea7d9903b9f77ff4280ffca17e", @@ -11066,7 +9356,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.create", @@ -11090,21 +9380,7 @@ "confirmationRequired": true, "description": "create operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "f0b03577e2c3bd5b128c24779dd7474d456d72c9f38ca785afdbce8a6889e306", @@ -11116,7 +9392,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.delete", @@ -11140,21 +9416,7 @@ "confirmationRequired": true, "description": "delete operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "c50e1c00dc4ebb458d3f9746da91b03bbcfee91c6c36278fcfc022727a00a910", @@ -11166,7 +9428,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.fail", @@ -11190,25 +9452,7 @@ "confirmationRequired": true, "description": "fail operation." }, - "changes": { - "authority": { - "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", - "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "187758e56dac67c921ab4ee834d5d81b8e599015a8a7f8e81c2e2ef45c0c710b", @@ -11220,7 +9464,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.get", @@ -11244,21 +9488,7 @@ "confirmationRequired": false, "description": "get operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "658bf990d861fe06857476b2fffe60754cd50c1d20ccb07bf7c0e6714aef6312", @@ -11270,7 +9500,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.list", @@ -11294,21 +9524,7 @@ "confirmationRequired": false, "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "8ae912351bc8a7b4570606c70aae9af21938242e346e896646810cfee24f86d8", @@ -11320,7 +9536,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.retry", @@ -11344,25 +9560,7 @@ "confirmationRequired": true, "description": "retry operation." }, - "changes": { - "authority": { - "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", - "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "e5c4ce75db8c161e1bebb2fdf19976ad01670d082a6fdef1e02ed06763ca2fa5", @@ -11374,7 +9572,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.start", @@ -11398,25 +9596,7 @@ "confirmationRequired": true, "description": "start operation." }, - "changes": { - "authority": { - "old": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use their designated signed approval flow. Retry additionally requires an eligible failed automation task.", - "new": "Manual tasks require Request.Write or Request.Manager; automation tasks require Request.Execute or Request.Manager in the task organization. Approval tasks use the designated authenticated approver operations in helpdesk_automation or the existing signed approval flow. Retry additionally requires an eligible failed automation task." - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "909ff6d7c3beeacb8765a699283bc29fadcd660de157e7ada0b919e21479d09c", @@ -11428,7 +9608,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_request_tasks.update", @@ -11452,21 +9632,7 @@ "confirmationRequired": true, "description": "update operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "9770ee49bdee60d544a5a417eda5f8c4e54898ec128da3b40904a55a93d4ed2a", @@ -11478,7 +9644,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.add_worklog", @@ -11502,21 +9668,7 @@ "confirmationRequired": true, "description": "add_worklog requests." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "7ee1fbd727b48277fbc8622e8c6a2d9d6725e7891b639007154194eb3fb2f27f", @@ -11528,7 +9680,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.assign", @@ -11552,21 +9704,7 @@ "confirmationRequired": true, "description": "assign operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "4dd593094b8ec82cf0528f0c32a63679043c11178b1f54b3a983734caa36234e", @@ -11578,7 +9716,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.assign_self", @@ -11602,21 +9740,7 @@ "confirmationRequired": true, "description": "assign_self operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "1e1dc78530dc4b911ac582fb185a2a731d98e550a755b6ce1c7aa6482944f0be", @@ -11628,7 +9752,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.attachments_count", @@ -11652,21 +9776,7 @@ "confirmationRequired": false, "description": "Read attachments_count for one request." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "4d2cd9f2a372eadcaa55542c3970ccdb9e8b91abc71aa70bb28719d191d5337c", @@ -11678,7 +9788,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.bulk_create", @@ -11702,21 +9812,7 @@ "confirmationRequired": true, "description": "bulk_create operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "157c61ad935a37a95112b1b395012821b992f8847adafaa8c1ae1fd8b7bd82da", @@ -11728,7 +9824,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.bulk_state", @@ -11752,21 +9848,7 @@ "confirmationRequired": true, "description": "bulk_state operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "2f7727f1b4c0c24fd97b4b501e984ef919436538f5b326713dea4901c12a1173", @@ -11778,7 +9860,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.create", @@ -11802,21 +9884,7 @@ "confirmationRequired": true, "description": "create requests." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "77a601b1f4e601f187f250f1a31310d6ab9b68d6501623fa267d9bcc7859d0b5", @@ -11828,7 +9896,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.delete", @@ -11852,21 +9920,7 @@ "confirmationRequired": true, "description": "delete requests." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "047289fb1c3c9765ccb136e4a8c4d86e044c3006f273dba348518e80cb83c378", @@ -11878,7 +9932,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.get", @@ -11902,21 +9956,7 @@ "confirmationRequired": false, "description": "get requests." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "00dac62eea5f92bf66523219748997bc955b29dbb5f212b6d3298bfeea94a5d3", @@ -11928,7 +9968,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.list", @@ -11952,21 +9992,7 @@ "confirmationRequired": false, "description": "List authorized tickets. request.query maps to API q; request.q is an alias. Equivalent trimmed aliases deduplicate; conflicting nonempty aliases fail validation. Null or blank search is unfiltered; filtering precedes counts and paging. Explicit page must be an integer from 1 to 1000000; pageSize from 1 to 100. Omitted pagination retains API behavior." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "a2a08783b6edc6218e45fd2436c8b325487733c0a753dd17c67ffe9a08b7d6e7", @@ -11978,7 +10004,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.listeners_count", @@ -12002,21 +10028,7 @@ "confirmationRequired": false, "description": "Read listeners_count for one request." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "0210d6ea1487ee22766ce5bdadba29b08015fd50cf5fe3132876568daa7824f0", @@ -12028,7 +10040,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.state", @@ -12052,21 +10064,7 @@ "confirmationRequired": true, "description": "state requests." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "c921fa7be851d7cdc9582350fbfa9ef122194cbfcfaf7d63babddaf733d3d25c", @@ -12078,7 +10076,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.tasks", @@ -12102,21 +10100,7 @@ "confirmationRequired": false, "description": "tasks requests." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "f457e59f412bfc1fa4b2d63e50bd0590e2a56193983aa20089006181b7378040", @@ -12128,7 +10112,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.timeline", @@ -12152,21 +10136,7 @@ "confirmationRequired": false, "description": "Read the authorized timeline. recordedHours is the nullable authoritative effort snapshot and workLogId the associated worklog; null effort is unavailable or not applicable, distinct from measured zero. Legacy hours remains numeric for compatibility." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "8459e086d939ecebf29ef973edf89cf8c02a83212f44196e6e760b6ef93bdc0a", @@ -12178,7 +10148,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.timeline_count", @@ -12202,21 +10172,7 @@ "confirmationRequired": false, "description": "Read timeline_count for one request." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "d94e202dc8d4e9288166cac4194f2dcf43d940a9a2b767eb7b687ef3ab594fb0", @@ -12228,7 +10184,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_requests.update", @@ -12252,21 +10208,7 @@ "confirmationRequired": true, "description": "update requests." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "4d91f2ff1bf302d986a3187e18d8353056b1951d5f0632aea15eaf304016501e", @@ -12278,7 +10220,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_roles.get", @@ -12302,21 +10244,7 @@ "confirmationRequired": false, "description": "get operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "0b0acfb3ccc96b2cf3d70fa29228362103ba693cf9a0938fd5680f0a3488b8d5", @@ -12328,7 +10256,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_roles.list", @@ -12352,21 +10280,7 @@ "confirmationRequired": false, "description": "list operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "1b186d641c751c520d539f85c00c09eebf629b73f357dd3ec7ee8e4b0f3086a9", @@ -12378,7 +10292,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_schema.list", @@ -12402,21 +10316,7 @@ "confirmationRequired": false, "description": "Read the executable MCP operation catalog." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -12428,7 +10328,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_search.customers", @@ -12452,30 +10352,7 @@ "confirmationRequired": false, "description": "customers operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "af316570e7cab1b496dd05d4ef6a4d1eb3e4973ac66298aec5468905d8c13d75", @@ -12487,7 +10364,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_search.organizations", @@ -12511,30 +10388,7 @@ "confirmationRequired": false, "description": "organizations operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "e98e7ffef49f503baea490a7bf3928e9711114c81f73444280c0e91aa1500e1f", @@ -12546,7 +10400,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_search.users", @@ -12570,30 +10424,7 @@ "confirmationRequired": false, "description": "users operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "ef572c3a5047bbd1dc78b0a872d7dc394ff23fe9c7baa10cbc9ffbeb9be4f47a", @@ -12605,7 +10436,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_self_service.get_request", @@ -12629,21 +10460,7 @@ "confirmationRequired": false, "description": "get_request operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "0cdb3406b7f1af76fd54421125b60cd7949ab742ffacaa5219219f6ed49954b7", @@ -12655,7 +10472,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_self_service.request_users", @@ -12679,21 +10496,7 @@ "confirmationRequired": false, "description": "request_users operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "ac14f0fcaeb54b7597153100a0219962fcc75587a2e228afb1b71bfe16828b8c", @@ -12705,7 +10508,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_self_service.requests", @@ -12729,21 +10532,7 @@ "confirmationRequired": false, "description": "requests operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "0d90cef17d1f4d123d02376ee28818ec54691e84f1c286f4ae9d044785eca5c5", @@ -12755,7 +10544,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_services.breadcrumb", @@ -12779,21 +10568,7 @@ "confirmationRequired": false, "description": "breadcrumb operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "1bb1bd83f6511de20634ff822e73bc206b8ea4ee599c9ab5bc4937d9a4096fdb", @@ -12805,7 +10580,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_services.get", @@ -12829,21 +10604,7 @@ "confirmationRequired": false, "description": "get operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "39c09b1b85cf9ac261ac744a592f7b506f6f8d1bf4e6f4f0d9ef2ea1e0522c0c", @@ -12855,7 +10616,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_services.items", @@ -12879,21 +10640,7 @@ "confirmationRequired": false, "description": "items operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "388cbda4d4f36d22c953826cc7699e05b8e6416ffdb61df051423cf0fbe8caa0", @@ -12905,7 +10652,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_services.list", @@ -12929,30 +10676,7 @@ "confirmationRequired": false, "description": "list operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "2a6f6b59ab48b502eb0b67fbcd9e2af7e6c4d472ba89fc556c039d512eb0e3b9", @@ -12964,7 +10688,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_services.search_items", @@ -12988,21 +10712,7 @@ "confirmationRequired": false, "description": "search_items operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "e91daf886523cffaa2c1329d627313dfb2b07213f9ec372e2112a54372dea93c", @@ -13014,13 +10724,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.breached", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.breached", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/breached", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read a page of breached open tickets." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -13031,31 +10749,32 @@ "description": "Read a page of breached open tickets." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "f1cd2435cbc3c33413d8c6b0a79d0afb1c860e42c5f71630bae9e7c9790dbd14", "currentRequestSchemaSha256": "f1cd2435cbc3c33413d8c6b0a79d0afb1c860e42c5f71630bae9e7c9790dbd14", - "newRequestProperties": [ - "page", - "pageSize", - "tenantId", - "ticketType" - ], + "newRequestProperties": [], "effect": "read", "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.calendars", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.calendars", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/sla-calendars/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read business calendars, weekly hours and date exceptions." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -13068,7 +10787,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -13077,13 +10796,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.completed", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.completed", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/completed", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read completed ticket SLA outcomes for a declared period." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -13094,34 +10821,32 @@ "description": "Read completed ticket SLA outcomes for a declared period." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "88fc1c7d20a13d873601871b892e8b9927707a88df14f6c6fa9a246742a7936c", "currentRequestSchemaSha256": "88fc1c7d20a13d873601871b892e8b9927707a88df14f6c6fa9a246742a7936c", - "newRequestProperties": [ - "fromUtc", - "page", - "pageSize", - "tenantId", - "ticketType", - "toUtc", - "withinResolutionSla" - ], + "newRequestProperties": [], "effect": "read", "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.compliance", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.compliance", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/compliance", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read SLA compliance for a declared period and ticket type." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -13132,31 +10857,32 @@ "description": "Read SLA compliance for a declared period and ticket type." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "61253a6b7e702b7814cc02ec19ec05838cba5baa38b3f57e557f6def2c58a9d8", "currentRequestSchemaSha256": "61253a6b7e702b7814cc02ec19ec05838cba5baa38b3f57e557f6def2c58a9d8", - "newRequestProperties": [ - "fromUtc", - "tenantId", - "ticketType", - "toUtc" - ], + "newRequestProperties": [], "effect": "read", "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.create_calendar", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.create_calendar", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/sla-calendars/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a validated business-hours calendar." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -13167,28 +10893,32 @@ "description": "Create a validated business-hours calendar." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "45ebe9c8389ed3220a6823b1ac13cc3d613c5d2728a882da52f8a3c5c879ecf4", "currentRequestSchemaSha256": "45ebe9c8389ed3220a6823b1ac13cc3d613c5d2728a882da52f8a3c5c879ecf4", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.create_policy", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.create_policy", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/slas/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an SLA policy with its scope, matching rules, deadlines and escalations." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -13199,28 +10929,32 @@ "description": "Create an SLA policy with its scope, matching rules, deadlines and escalations." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "49f26e21ce7d342b23cb70ea911081da84cd3fe5d155e48536e7a5ae572d459a", "currentRequestSchemaSha256": "49f26e21ce7d342b23cb70ea911081da84cd3fe5d155e48536e7a5ae572d459a", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.create_report_subscription", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.create_report_subscription", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/sla-report-subscriptions/", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an SLA report schedule with explicit recipients and tenant scope." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -13231,28 +10965,32 @@ "description": "Create an SLA report schedule with explicit recipients and tenant scope." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "aba71baa72275ecaf83635b7226d7bc5bbc33f7dd63c0bb9e33ed68c4e81235e", "currentRequestSchemaSha256": "aba71baa72275ecaf83635b7226d7bc5bbc33f7dd63c0bb9e33ed68c4e81235e", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.delete_calendar", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.delete_calendar", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/sla-calendars/{calendarId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete a selected calendar subject to canonical usage constraints." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -13263,28 +11001,32 @@ "description": "Delete a selected calendar subject to canonical usage constraints." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "57ebfd5d3cc18a603b761a4fdf618742f1a4bbd1fe97a52dd40a684ba7e184e4", "currentRequestSchemaSha256": "57ebfd5d3cc18a603b761a4fdf618742f1a4bbd1fe97a52dd40a684ba7e184e4", - "newRequestProperties": [ - "calendarId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.delete_policy", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.delete_policy", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/slas/{policyId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete a selected SLA policy." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -13295,28 +11037,32 @@ "description": "Delete a selected SLA policy." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "b48757b90b4ecd9a96e321cfad5500b6f6597b75080a7320981a012b8af6dd10", "currentRequestSchemaSha256": "b48757b90b4ecd9a96e321cfad5500b6f6597b75080a7320981a012b8af6dd10", - "newRequestProperties": [ - "policyId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.delete_report_subscription", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.delete_report_subscription", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/sla-report-subscriptions/{subscriptionId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Remove one SLA report schedule." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -13327,28 +11073,32 @@ "description": "Remove one SLA report schedule." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "5460ea09580129457969c2e73affde13624e6e21404e80aad5f300936dbeb8af", "currentRequestSchemaSha256": "5460ea09580129457969c2e73affde13624e6e21404e80aad5f300936dbeb8af", - "newRequestProperties": [ - "subscriptionId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.near_breach", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.near_breach", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/reports/sla/near-breach", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read a page of tickets approaching the selected SLA threshold." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -13359,33 +11109,32 @@ "description": "Read a page of tickets approaching the selected SLA threshold." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "84a3a6909a21e7378590e22d22c7110a21bd00bd651d782b85fd4a569aef8995", "currentRequestSchemaSha256": "84a3a6909a21e7378590e22d22c7110a21bd00bd651d782b85fd4a569aef8995", - "newRequestProperties": [ - "metric", - "page", - "pageSize", - "tenantId", - "thresholdPercent", - "ticketType" - ], + "newRequestProperties": [], "effect": "read", "authority": "Ticket manager authority in the selected organization; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.pause_ticket", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.pause_ticket", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/sla/pause", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Pause one eligible ticket SLA with a recorded reason; parent ticket authorization is enforced." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -13396,29 +11145,32 @@ "description": "Pause one eligible ticket SLA with a recorded reason; parent ticket authorization is enforced." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0d6efd0234cb6cf144ab92148772dfdd62faf01f1d7cf2548ae7cd474961e2b5", "currentRequestSchemaSha256": "0d6efd0234cb6cf144ab92148772dfdd62faf01f1d7cf2548ae7cd474961e2b5", - "newRequestProperties": [ - "body", - "ticketId" - ], + "newRequestProperties": [], "effect": "write", "authority": "Parent ticket manager authority; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.policies", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.policies", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/slas/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read SLA policies and escalation rules." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -13431,7 +11183,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -13440,13 +11192,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.report_subscriptions", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.report_subscriptions", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/sla-report-subscriptions/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read scheduled SLA reports and recipients." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -13459,7 +11219,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -13468,13 +11228,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.resume_ticket", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.resume_ticket", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tickets/{ticketId}/sla/resume", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Resume one eligible ticket SLA through its canonical lifecycle." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -13485,29 +11253,32 @@ "description": "Resume one eligible ticket SLA through its canonical lifecycle." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ab8203b1be3ebf468ef55fdd54f5e5c9fc0d679f0070bafef78f23f64da85239", "currentRequestSchemaSha256": "ab8203b1be3ebf468ef55fdd54f5e5c9fc0d679f0070bafef78f23f64da85239", - "newRequestProperties": [ - "body", - "ticketId" - ], + "newRequestProperties": [], "effect": "write", "authority": "Parent ticket manager authority; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.save_tenant_settings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.save_tenant_settings", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenant-sla-settings/{tenantId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Save the selected tenant's business-hours and calendar settings." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -13518,29 +11289,32 @@ "description": "Save the selected tenant's business-hours and calendar settings." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "09c1fd777365eb0a7cec9fc4367976bb3182c3c98ea7c75b784568cccc4885c2", "currentRequestSchemaSha256": "09c1fd777365eb0a7cec9fc4367976bb3182c3c98ea7c75b784568cccc4885c2", - "newRequestProperties": [ - "body", - "tenantId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.tenant_settings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.tenant_settings", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-sla-settings/{tenantId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one tenant's business-hours and calendar selection." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -13551,28 +11325,32 @@ "description": "Read one tenant's business-hours and calendar selection." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "708aeaac2b35c4a7a643b142936e8ba9f1eaa167cff791cfaf05a72ef168407d", "currentRequestSchemaSha256": "708aeaac2b35c4a7a643b142936e8ba9f1eaa167cff791cfaf05a72ef168407d", - "newRequestProperties": [ - "tenantId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.update_calendar", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.update_calendar", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/sla-calendars/{calendarId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update calendar rules and exceptions." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -13583,29 +11361,32 @@ "description": "Update calendar rules and exceptions." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9958ab9b36edd137e873c7f8fbf9fc89132a1a5b4d0f662921ec4666d2f79d68", "currentRequestSchemaSha256": "9958ab9b36edd137e873c7f8fbf9fc89132a1a5b4d0f662921ec4666d2f79d68", - "newRequestProperties": [ - "body", - "calendarId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.update_policy", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.update_policy", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/slas/{policyId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update an existing SLA policy using canonical validation and audit events." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -13616,29 +11397,32 @@ "description": "Update an existing SLA policy using canonical validation and audit events." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8f94da82f6adbd0472e4c6c7a2b239027e909202f330bde1a36808020a72c904", "currentRequestSchemaSha256": "8f94da82f6adbd0472e4c6c7a2b239027e909202f330bde1a36808020a72c904", - "newRequestProperties": [ - "body", - "policyId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_sla.update_report_subscription", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_sla.update_report_subscription", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/sla-report-subscriptions/{subscriptionId}", + "effect": "external_io", + "readOnly": false, + "confirmationRequired": true, + "description": "Update or disable an SLA report schedule." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -13649,29 +11433,32 @@ "description": "Update or disable an SLA report schedule." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "3979ce851116a7e60a9b358f9c4d0c711117a08505262aa4b4bdee8c24ed3685", "currentRequestSchemaSha256": "3979ce851116a7e60a9b358f9c4d0c711117a08505262aa4b4bdee8c24ed3685", - "newRequestProperties": [ - "body", - "subscriptionId" - ], + "newRequestProperties": [], "effect": "external_io", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.add_member", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.add_member", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Add an existing user to the selected support group with explicit membership role and source." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -13682,29 +11469,32 @@ "description": "Add an existing user to the selected support group with explicit membership role and source." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "cf37b6d897bd565174546b0d26640e8fd669f3302f76e23c44396b921f85f23c", "currentRequestSchemaSha256": "cf37b6d897bd565174546b0d26640e8fd669f3302f76e23c44396b921f85f23c", - "newRequestProperties": [ - "body", - "groupId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.bootstrap_defaults", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.bootstrap_defaults", + "baselineContract": { + "requestContract": "None", + "method": "POST", + "pathTemplate": "/api/v1/support/bootstrap/defaults", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Ensure the instance's default support configuration using the canonical idempotent bootstrapper." + }, "currentContract": { "requestContract": "None", "method": "POST", @@ -13717,7 +11507,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "write", @@ -13726,13 +11516,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.coverage", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.coverage", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/coverage/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List customer-to-provider support coverage routes." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -13743,28 +11541,32 @@ "description": "List customer-to-provider support coverage routes." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "5e31e1d8a8367ab3bcb8d3d0be01bdf756896ef45b946a4e7c68bff4d319577c", "currentRequestSchemaSha256": "5e31e1d8a8367ab3bcb8d3d0be01bdf756896ef45b946a4e7c68bff4d319577c", - "newRequestProperties": [ - "customerOrganizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.create_coverage", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.create_coverage", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/coverage/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create explicit customer, provider and group coverage with a primary or backup role." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -13775,28 +11577,32 @@ "description": "Create explicit customer, provider and group coverage with a primary or backup role." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "99046a242760c50015e8aab89f4f5ba02a48cca054d0e25656dec4085890721d", "currentRequestSchemaSha256": "99046a242760c50015e8aab89f4f5ba02a48cca054d0e25656dec4085890721d", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.create_group", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.create_group", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/groups/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a support group in its owning organization." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -13807,28 +11613,32 @@ "description": "Create a support group in its owning organization." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "95b8d237d00e30f37263fd9288555855745cb0a2f6bcce1fe228c5fc08e81da7", "currentRequestSchemaSha256": "95b8d237d00e30f37263fd9288555855745cb0a2f6bcce1fe228c5fc08e81da7", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.create_subscription", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.create_subscription", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/support/notification-subscriptions/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an explicit event and recipient subscription; only configured supported delivery channels are accepted." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -13839,28 +11649,32 @@ "description": "Create an explicit event and recipient subscription; only configured supported delivery channels are accepted." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "57d9a51cb4fc9e97fc7c6f25824bbf531314349c39dd3bf538d70ae7465deb19", "currentRequestSchemaSha256": "57d9a51cb4fc9e97fc7c6f25824bbf531314349c39dd3bf538d70ae7465deb19", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.delete_coverage", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.delete_coverage", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/coverage/{coverageId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one explicitly selected support coverage route." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -13871,28 +11685,32 @@ "description": "Delete one explicitly selected support coverage route." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "85ea06e740887c83284098d7a74de4732291e18710c530bf5218c55c8fb5bf10", "currentRequestSchemaSha256": "85ea06e740887c83284098d7a74de4732291e18710c530bf5218c55c8fb5bf10", - "newRequestProperties": [ - "coverageId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.delete_group", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.delete_group", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/groups/{groupId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one support group through the canonical repository rules." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -13903,28 +11721,32 @@ "description": "Delete one support group through the canonical repository rules." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "00d90fe00707a37ec073afcc1c5884b75b02bb505d9eeab6e80972c9326529f3", "currentRequestSchemaSha256": "00d90fe00707a37ec073afcc1c5884b75b02bb505d9eeab6e80972c9326529f3", - "newRequestProperties": [ - "groupId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.delete_subscription", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.delete_subscription", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/notification-subscriptions/{subscriptionId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete one support notification subscription." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -13935,28 +11757,32 @@ "description": "Delete one support notification subscription." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "5460ea09580129457969c2e73affde13624e6e21404e80aad5f300936dbeb8af", "currentRequestSchemaSha256": "5460ea09580129457969c2e73affde13624e6e21404e80aad5f300936dbeb8af", - "newRequestProperties": [ - "subscriptionId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.get_group", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.get_group", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/groups/{groupId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one support group." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -13967,28 +11793,32 @@ "description": "Read one support group." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "00d90fe00707a37ec073afcc1c5884b75b02bb505d9eeab6e80972c9326529f3", "currentRequestSchemaSha256": "00d90fe00707a37ec073afcc1c5884b75b02bb505d9eeab6e80972c9326529f3", - "newRequestProperties": [ - "groupId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.groups", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.groups", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/groups/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List support groups, optionally for one owning organization." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -13999,28 +11829,32 @@ "description": "List support groups, optionally for one owning organization." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "d8ad96e7155f79f1c93b9334666ac05ee20f3eccde8c66166e56ec2c1f2caac7", "currentRequestSchemaSha256": "d8ad96e7155f79f1c93b9334666ac05ee20f3eccde8c66166e56ec2c1f2caac7", - "newRequestProperties": [ - "owningOrganizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.members", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.members", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List the selected support group's members and enabled state." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -14031,28 +11865,32 @@ "description": "List the selected support group's members and enabled state." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "00d90fe00707a37ec073afcc1c5884b75b02bb505d9eeab6e80972c9326529f3", "currentRequestSchemaSha256": "00d90fe00707a37ec073afcc1c5884b75b02bb505d9eeab6e80972c9326529f3", - "newRequestProperties": [ - "groupId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.my_preferences", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.my_preferences", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/support/notification-preferences/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authenticated caller's own support notification preferences." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -14065,7 +11903,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -14074,13 +11912,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.recipient_preview", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.recipient_preview", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/organizations/{organizationId}/recipient-preview", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Resolve the actual recipients for one organization event without sending mail." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -14091,29 +11937,32 @@ "description": "Resolve the actual recipients for one organization event without sending mail." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "44a0a1f9046ba291d1c622171218f65477bb76e1ad7971eae4da36bb5064e9c7", "currentRequestSchemaSha256": "44a0a1f9046ba291d1c622171218f65477bb76e1ad7971eae4da36bb5064e9c7", - "newRequestProperties": [ - "eventType", - "organizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.remove_member", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.remove_member", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/{memberId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Remove one membership from its verified group." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -14124,29 +11973,32 @@ "description": "Remove one membership from its verified group." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "08b9c66456b81a8b50e93b866390585f788d442a0a190e4139bed72c3ddb0675", "currentRequestSchemaSha256": "08b9c66456b81a8b50e93b866390585f788d442a0a190e4139bed72c3ddb0675", - "newRequestProperties": [ - "groupId", - "memberId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.set_my_preference", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.set_my_preference", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/notification-preferences/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update one of the authenticated caller's preferences; the server selects the caller identity." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -14157,28 +12009,32 @@ "description": "Update one of the authenticated caller's preferences; the server selects the caller identity." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0f1445231f1d4e479a355468d64cdb4457bbd5878f29480dee8fa3e893d2256b", "currentRequestSchemaSha256": "0f1445231f1d4e479a355468d64cdb4457bbd5878f29480dee8fa3e893d2256b", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "NotificationAccess for the authenticated caller; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.set_user_preference", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.set_user_preference", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/users/{userId}/notification-preferences/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update a selected user's preference under administrator authority; the route determines the target user." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -14189,29 +12045,32 @@ "description": "Update a selected user's preference under administrator authority; the route determines the target user." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8a959143d1ac49e6651fecb2d324372736f7121b7494a9a685c2609386cdd6b2", "currentRequestSchemaSha256": "8a959143d1ac49e6651fecb2d324372736f7121b7494a9a685c2609386cdd6b2", - "newRequestProperties": [ - "body", - "userId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.subscriptions", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.subscriptions", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/notification-subscriptions/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List support notification subscriptions for one or all customer organizations." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -14222,28 +12081,32 @@ "description": "List support notification subscriptions for one or all customer organizations." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "5e31e1d8a8367ab3bcb8d3d0be01bdf756896ef45b946a4e7c68bff4d319577c", "currentRequestSchemaSha256": "5e31e1d8a8367ab3bcb8d3d0be01bdf756896ef45b946a4e7c68bff4d319577c", - "newRequestProperties": [ - "customerOrganizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" - }, - { - "operationKey": "helpdesk_support.update_coverage", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "campaignOutcome": "requires_fresh_beta11_operator_evidence" + }, + { + "operationKey": "helpdesk_support.update_coverage", + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.update_coverage", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/coverage/{coverageId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update or disable a saved support coverage route." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -14254,29 +12117,32 @@ "description": "Update or disable a saved support coverage route." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c8aad4740b3c38079b1c59cb272543e3768921cd37312d19ad369e2228b9c067", "currentRequestSchemaSha256": "c8aad4740b3c38079b1c59cb272543e3768921cd37312d19ad369e2228b9c067", - "newRequestProperties": [ - "body", - "coverageId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.update_group", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.update_group", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/groups/{groupId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update support group metadata and enabled status." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -14287,29 +12153,32 @@ "description": "Update support group metadata and enabled status." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4864c451b7b20cb70d5b160560a1623587408ae2537cd4bb63ae7a32e4bd8ad8", "currentRequestSchemaSha256": "4864c451b7b20cb70d5b160560a1623587408ae2537cd4bb63ae7a32e4bd8ad8", - "newRequestProperties": [ - "body", - "groupId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.update_member", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.update_member", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/groups/{groupId}/members/{memberId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update or disable an existing membership; the API verifies that it belongs to the selected group." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -14320,30 +12189,32 @@ "description": "Update or disable an existing membership; the API verifies that it belongs to the selected group." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "5e4a7782f34dec394de44a696a78d1ea99c64f3f84c001a1547331e2d5b42b90", "currentRequestSchemaSha256": "5e4a7782f34dec394de44a696a78d1ea99c64f3f84c001a1547331e2d5b42b90", - "newRequestProperties": [ - "body", - "groupId", - "memberId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.update_subscription", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.update_subscription", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/support/notification-subscriptions/{subscriptionId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update or disable one support notification subscription." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -14354,29 +12225,32 @@ "description": "Update or disable one support notification subscription." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "6b6eed380c0f2de7bd1ef8b3cb0e62b3e29cc923480f9290af50de43cef972e3", "currentRequestSchemaSha256": "6b6eed380c0f2de7bd1ef8b3cb0e62b3e29cc923480f9290af50de43cef972e3", - "newRequestProperties": [ - "body", - "subscriptionId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_support.user_preferences", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_support.user_preferences", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/support/users/{userId}/notification-preferences/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one selected user's notification preferences under administrator authority." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -14387,22 +12261,18 @@ "description": "Read one selected user's notification preferences under administrator authority." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", - "newRequestProperties": [ - "userId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_system.version", @@ -14426,21 +12296,7 @@ "confirmationRequired": false, "description": "Read safe system metadata." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", @@ -14452,13 +12308,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.assets", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.assets", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/assets/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List asset records visible to the authorized instance administrator." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -14471,7 +12335,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -14480,13 +12344,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.assignments", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.assignments", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/{userId}/assignments", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the selected local user's role assignments within this organization." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -14497,29 +12369,32 @@ "description": "Read the selected local user's role assignments within this organization." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "abf3ba1abb858db27c90cf858c482bc6c29b9fefaf1d9836646c0aefb43efc91", "currentRequestSchemaSha256": "abf3ba1abb858db27c90cf858c482bc6c29b9fefaf1d9836646c0aefb43efc91", - "newRequestProperties": [ - "organizationId", - "userId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Tenant role-management authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.background_worker_settings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.background_worker_settings", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/ops/hangfire/settings", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved background-worker enablement, actual queue/storage runtime and recurring/Graph synchronization job counts." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -14532,7 +12407,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -14541,13 +12416,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.create_asset", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.create_asset", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/assets/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create an asset with an explicit organization identifier and bounded inventory fields. An explicit empty organizationId preserves the canonical unassigned asset behavior. The API assigns its identifier." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -14558,28 +12441,32 @@ "description": "Create an asset with an explicit organization identifier and bounded inventory fields. An explicit empty organizationId preserves the canonical unassigned asset behavior. The API assigns its identifier." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "fe900e5cc7e2a8a9eb6be3f18e3174123682335fb272e9ced7932f51cb4b7a0f", "currentRequestSchemaSha256": "fe900e5cc7e2a8a9eb6be3f18e3174123682335fb272e9ced7932f51cb4b7a0f", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.create_local_account", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.create_local_account", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Create a local account and return its newly issued one-time activation token as an explicitly sensitive result. This does not read an existing password. Deliver the token only through the authorized private activation workflow." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -14590,28 +12477,32 @@ "description": "Create a local account and return its newly issued one-time activation token as an explicitly sensitive result. This does not read an existing password. Deliver the token only through the authorized private activation workflow." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "3004a256b149a14d18f867e4bf76ffeea55fdf571a16ebde2285e0ad9c3e90d4", "currentRequestSchemaSha256": "3004a256b149a14d18f867e4bf76ffeea55fdf571a16ebde2285e0ad9c3e90d4", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.customer_dashboard", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.customer_dashboard", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/dashboard/customer-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the current linked customer's ticket summary. An account with no linked customer receives the canonical empty summary." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -14624,7 +12515,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -14633,13 +12524,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.dashboard", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.dashboard", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/dashboard/admin-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read live administrative incident, request and change dashboard metrics." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -14652,7 +12551,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -14661,13 +12560,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.delegable_roles", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.delegable_roles", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/roles", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List operational built-in and tenant-owned roles that may be delegated in this organization." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -14678,28 +12585,32 @@ "description": "List operational built-in and tenant-owned roles that may be delegated in this organization." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", "currentRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", - "newRequestProperties": [ - "organizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Tenant role-management authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.delete_asset", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.delete_asset", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/assets/{assetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Delete exactly one selected asset through the canonical administrator endpoint." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -14710,28 +12621,32 @@ "description": "Delete exactly one selected asset through the canonical administrator endpoint." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "96769b07ad76e1a25c965b905d7ad7495cc88496650a62907cd5d8cb52ed19a0", "currentRequestSchemaSha256": "96769b07ad76e1a25c965b905d7ad7495cc88496650a62907cd5d8cb52ed19a0", - "newRequestProperties": [ - "assetId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.delete_my_credential_record", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.delete_my_credential_record", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/integration-credentials/{credentialId}/record", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Revoke and permanently remove one of the authenticated owner's credential records through the canonical lifecycle. Read owned metadata first and preserve any required audit evidence before confirmation." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -14742,28 +12657,32 @@ "description": "Revoke and permanently remove one of the authenticated owner's credential records through the canonical lifecycle. Read owned metadata first and preserve any required audit evidence before confirmation." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9fcfd10ec8f3ab1fee809af034a64c4ebf2f492a92c99361dc33ec32762479b6", "currentRequestSchemaSha256": "9fcfd10ec8f3ab1fee809af034a64c4ebf2f492a92c99361dc33ec32762479b6", - "newRequestProperties": [ - "credentialId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.disable_local_account", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.disable_local_account", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users/{userId}/disable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Disable a local account through the existing administrator lifecycle, including session/credential invalidation." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -14774,28 +12693,32 @@ "description": "Disable a local account through the existing administrator lifecycle, including session/credential invalidation." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", - "newRequestProperties": [ - "userId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.enable_local_account", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.enable_local_account", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users/{userId}/enable", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Enable a disabled local account." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -14806,28 +12729,32 @@ "description": "Enable a disabled local account." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", - "newRequestProperties": [ - "userId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.get_asset", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.get_asset", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/assets/{assetId}", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the selected asset and its saved organization before editing." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -14838,28 +12765,32 @@ "description": "Read the selected asset and its saved organization before editing." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "96769b07ad76e1a25c965b905d7ad7495cc88496650a62907cd5d8cb52ed19a0", "currentRequestSchemaSha256": "96769b07ad76e1a25c965b905d7ad7495cc88496650a62907cd5d8cb52ed19a0", - "newRequestProperties": [ - "assetId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.instance_branding", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.instance_branding", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/admin/branding/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read effective instance branding, persisted values, defaults and each field's source/editability. Deployment-owned values remain authoritative." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -14872,7 +12803,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -14881,13 +12812,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.local_account_assignments", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.local_account_assignments", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/local-auth/users/{userId}/assignments", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read all scoped role assignments and local/instance-administrator flags for one account." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -14898,28 +12837,32 @@ "description": "Read all scoped role assignments and local/instance-administrator flags for one account." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", - "newRequestProperties": [ - "userId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.local_account_status", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.local_account_status", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/local-auth/users/{userId}/status", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read a local account's enabled status." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -14930,28 +12873,32 @@ "description": "Read a local account's enabled status." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", - "newRequestProperties": [ - "userId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.members", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.members", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List local team members and their scoped role assignments." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -14962,28 +12909,32 @@ "description": "List local team members and their scoped role assignments." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", "currentRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", - "newRequestProperties": [ - "organizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Tenant user read/manage authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.my_credentials", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.my_credentials", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/integration-credentials/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List the authenticated owner's integration credential metadata, scopes, expiry and revocation state. Never returns credential secrets or another owner's records; creating additional account credentials retains its separate interactive consent boundary." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -14996,7 +12947,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -15005,13 +12956,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.online_users", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.online_users", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/presence/online-users", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read identities currently connected to the platform's presence service." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -15024,7 +12983,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -15033,13 +12992,21 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.organizations", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.organizations", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "List the organizations the caller can administer." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -15052,7 +13019,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -15061,13 +13028,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.replace_assignments", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.replace_assignments", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/users/{userId}/assignments", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the selected local user's delegable role assignments; an empty list removes those assignments. Other scopes and instance-admin authority remain governed by the API." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -15078,30 +13053,32 @@ "description": "Replace the selected local user's delegable role assignments; an empty list removes those assignments. Other scopes and instance-admin authority remain governed by the API." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "89fd9d83ee4987924c53df577b17b0c2b4da09f1587e5380751955c224f0e80e", "currentRequestSchemaSha256": "89fd9d83ee4987924c53df577b17b0c2b4da09f1587e5380751955c224f0e80e", - "newRequestProperties": [ - "body", - "organizationId", - "userId" - ], + "newRequestProperties": [], "effect": "write", "authority": "Tenant role-management authority or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.replace_local_account_assignments", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.replace_local_account_assignments", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/local-auth/users/{userId}/assignments", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the selected non-instance-admin account's explicit scoped role assignments; each role and organization is validated by the API." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -15112,29 +13089,32 @@ "description": "Replace the selected non-instance-admin account's explicit scoped role assignments; each role and organization is validated by the API." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "871c712c6a65ca04108df2d074699d2934ee89df2457702e3c63f0fd969e4454", "currentRequestSchemaSha256": "871c712c6a65ca04108df2d074699d2934ee89df2457702e3c63f0fd969e4454", - "newRequestProperties": [ - "body", - "userId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.reset_customer_login", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.reset_customer_login", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/customers/{customerId}/auth/local-activation-token", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Issue a new one-time activation token for the customer's single linked enabled local account. Inspect helpdesk_customers.auth_status first; external customer invite/resend/sync flows have their separate identity-provider contract." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -15145,28 +13125,32 @@ "description": "Issue a new one-time activation token for the customer's single linked enabled local account. Inspect helpdesk_customers.auth_status first; external customer invite/resend/sync flows have their separate identity-provider contract." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "345ac1bf3ec630ea7bc5aa539e695cfc226f161f34b706de6ae2de99d70b7c0f", "currentRequestSchemaSha256": "345ac1bf3ec630ea7bc5aa539e695cfc226f161f34b706de6ae2de99d70b7c0f", - "newRequestProperties": [ - "customerId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.reset_local_account", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.reset_local_account", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/local-auth/users/{userId}/activation-token", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Issue a new one-time local-account activation token as an explicitly sensitive result; preserve it only through the authorized private activation workflow." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -15177,28 +13161,32 @@ "description": "Issue a new one-time local-account activation token as an explicitly sensitive result; preserve it only through the authorized private activation workflow." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", "currentRequestSchemaSha256": "a20fa7cc6070df4aca84b926290d1c6231eac7466c962b4632333cdc239aee05", - "newRequestProperties": [ - "userId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.revoke_my_credential", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.revoke_my_credential", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "DELETE", + "pathTemplate": "/api/v1/integration-credentials/{credentialId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Revoke one of the authenticated owner's credentials. Existing cached execution tokens are invalidated by current credential checks. A credential owned by another account remains inaccessible." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "DELETE", @@ -15209,28 +13197,32 @@ "description": "Revoke one of the authenticated owner's credentials. Existing cached execution tokens are invalidated by current credential checks. A credential owned by another account remains inaccessible." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9fcfd10ec8f3ab1fee809af034a64c4ebf2f492a92c99361dc33ec32762479b6", "currentRequestSchemaSha256": "9fcfd10ec8f3ab1fee809af034a64c4ebf2f492a92c99361dc33ec32762479b6", - "newRequestProperties": [ - "credentialId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.settings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.settings", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/settings/", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read one organization's display and contact settings." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -15241,28 +13233,32 @@ "description": "Read one organization's display and contact settings." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", "currentRequestSchemaSha256": "c5e8795213ca38ebdd26d4cfe54ff45f9a7b18e29c81bd73279da8293f9de837", - "newRequestProperties": [ - "organizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Tenant.Settings.Manage in organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.technician_dashboard", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.technician_dashboard", + "baselineContract": { + "requestContract": "None", + "method": "GET", + "pathTemplate": "/api/v1/dashboard/technician-summary", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the authenticated technician's authorized open ticket counts." + }, "currentContract": { "requestContract": "None", "method": "GET", @@ -15275,7 +13271,7 @@ "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], - "baselineRequestSchemaSha256": null, + "baselineRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "currentRequestSchemaSha256": "74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b", "newRequestProperties": [], "effect": "read", @@ -15284,13 +13280,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.tenant_branding", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.tenant_branding", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/tenants/{brandingTenantId}/branding", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read saved or default email branding for the canonical positive integer branding tenant identifier; organization and SLA identifiers remain separate string selectors." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -15301,28 +13305,32 @@ "description": "Read saved or default email branding for the canonical positive integer branding tenant identifier; organization and SLA identifiers remain separate string selectors." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "38e7516577df36987eca59266880ffaed27563bbcb6166ab8344edde34a13b01", "currentRequestSchemaSha256": "38e7516577df36987eca59266880ffaed27563bbcb6166ab8344edde34a13b01", - "newRequestProperties": [ - "brandingTenantId" - ], + "newRequestProperties": [], "effect": "read", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.update_asset", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.update_asset", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/assets/{assetId}", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Replace the selected asset's inventory fields and organization. Read current values first; supply all optional fields explicitly, using null only to clear them. The route determines the stored identifier." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -15333,29 +13341,32 @@ "description": "Replace the selected asset's inventory fields and organization. Read current values first; supply all optional fields explicitly, using null only to clear them. The route determines the stored identifier." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "cba867c49637be359b313e157cb0522dc10a193e7afcca2f35ea70298b2c0f1b", "currentRequestSchemaSha256": "cba867c49637be359b313e157cb0522dc10a193e7afcca2f35ea70298b2c0f1b", - "newRequestProperties": [ - "assetId", - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.update_background_worker_settings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.update_background_worker_settings", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/ops/hangfire/settings", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Explicitly enable or disable background processing through the runtime administration service, which reconciles Graph dataset schedules. Inspect pending work before disabling, and verify the resulting settings and job counts." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -15366,28 +13377,32 @@ "description": "Explicitly enable or disable background processing through the runtime administration service, which reconciles Graph dataset schedules. Inspect pending work before disabling, and verify the resulting settings and job counts." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "6d7afc647fa3a20f801e96b226c9325f586726118c6ec34db39cd0646b031f68", "currentRequestSchemaSha256": "6d7afc647fa3a20f801e96b226c9325f586726118c6ec34db39cd0646b031f68", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.update_instance_branding", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.update_instance_branding", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/admin/branding/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Save all instance branding fields after reading their current values and editability. Explicit null or blank resets an editable field to its configured default. The canonical provider preserves deployment-owned values and validates web/image URLs." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -15398,28 +13413,32 @@ "description": "Save all instance branding fields after reading their current values and editability. Explicit null or blank resets an editable field to its configured default. The canonical provider preserves deployment-owned values and validates web/image URLs." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "858d4480a7a74fe490103b0ae184e44e52e5c81bc49a33678f122451d907c3d0", "currentRequestSchemaSha256": "858d4480a7a74fe490103b0ae184e44e52e5c81bc49a33678f122451d907c3d0", - "newRequestProperties": [ - "body" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.update_settings", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.update_settings", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "PUT", + "pathTemplate": "/api/v1/tenant-admin/organizations/{organizationId}/settings/", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Update one organization's display and contact settings." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "PUT", @@ -15430,29 +13449,32 @@ "description": "Update one organization's display and contact settings." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "8b58b9fa0a57631560e40e1efa1183a3c895052d230273023e724f7d208821aa", "currentRequestSchemaSha256": "8b58b9fa0a57631560e40e1efa1183a3c895052d230273023e724f7d208821aa", - "newRequestProperties": [ - "body", - "organizationId" - ], + "newRequestProperties": [], "effect": "write", "authority": "Tenant.Settings.Manage in organization or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tenant_admin.upload_branding_logo", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tenant_admin.upload_branding_logo", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/tenants/{brandingTenantId}/branding/logo", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Upload one image logo of at most 1 MiB through the canonical multipart file endpoint, then read tenant branding to verify the stored logo URL. Use the positive integer branding tenant identifier." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -15463,23 +13485,18 @@ "description": "Upload one image logo of at most 1 MiB through the canonical multipart file endpoint, then read tenant branding to verify the stored logo URL. Use the positive integer branding tenant identifier." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "14ebbcfc56445456f1e0d23cc5997f03a314445fbd6115b3464be979d1653c33", "currentRequestSchemaSha256": "14ebbcfc56445456f1e0d23cc5997f03a314445fbd6115b3464be979d1653c33", - "newRequestProperties": [ - "body", - "brandingTenantId" - ], + "newRequestProperties": [], "effect": "write", "authority": "HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.attachments_count", @@ -15503,21 +13520,7 @@ "confirmationRequired": false, "description": "Count attachments." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "31a1988f8ce10e9139c9f0010b6d58b97d548a0b7d7eec388633c65e2200900b", @@ -15529,13 +13532,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.current_assignee", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.current_assignee", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/assignees/current", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Resolve an existing ticket assignment, including a retained user who is no longer eligible for a new assignment." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -15546,30 +13557,32 @@ "description": "Resolve an existing ticket assignment, including a retained user who is no longer eligible for a new assignment." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "1d02ea49b7aa66e095d3d1ec59a4c3e213974d15e884721b97563e518024238c", "currentRequestSchemaSha256": "1d02ea49b7aa66e095d3d1ec59a4c3e213974d15e884721b97563e518024238c", - "newRequestProperties": [ - "module", - "organizationId", - "ticketId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Visibility of the selected ticket and matching organization; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.customer_options", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.customer_options", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/customers", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read enabled customer choices for one authorized organization and ticket module." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -15580,29 +13593,32 @@ "description": "Read enabled customer choices for one authorized organization and ticket module." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0f30ac684e699c9c9358ce273db84230d18e4dd10068a2b4f1a23a4dd11a3044", "currentRequestSchemaSha256": "0f30ac684e699c9c9358ce273db84230d18e4dd10068a2b4f1a23a4dd11a3044", - "newRequestProperties": [ - "module", - "organizationId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Current module and organization authority; own-customer scope for non-managers; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.filter_options", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.filter_options", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/filter-options", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Search authorized organization, requested-for and assignee labels for ticket filters. selectedId and customerOrgId are bounded repeated query values." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -15613,33 +13629,32 @@ "description": "Search authorized organization, requested-for and assignee labels for ticket filters. selectedId and customerOrgId are bounded repeated query values." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "ff6c6eb8712387b46c482f7594cb2805e0626afc60504fd0a5a9699e30b733b9", "currentRequestSchemaSha256": "ff6c6eb8712387b46c482f7594cb2805e0626afc60504fd0a5a9699e30b733b9", - "newRequestProperties": [ - "customerOrgId", - "dimension", - "module", - "q", - "selectedId", - "take" - ], + "newRequestProperties": [], "effect": "read", "authority": "Current module ticket visibility; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.incident_activity", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.incident_activity", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/incidents/{incidentId}/activity", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the persisted incident activity audit, independently of the rendered timeline." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -15650,22 +13665,18 @@ "description": "Read the persisted incident activity audit, independently of the rendered timeline." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "5aa90f282e330d4f89c878c47ba5549a401e6da824ca4e66e6914877bb367ea8", "currentRequestSchemaSha256": "5aa90f282e330d4f89c878c47ba5549a401e6da824ca4e66e6914877bb367ea8", - "newRequestProperties": [ - "incidentId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Parent incident visibility; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.listeners_count", @@ -15689,21 +13700,7 @@ "confirmationRequired": false, "description": "Count listeners." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "b3bd6921b90d692533d0f43ead5983dad57061966eab039608a63ef2b8964ee3", @@ -15715,7 +13712,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.mark_as_seen", @@ -15739,21 +13736,7 @@ "confirmationRequired": true, "description": "mark_as_seen operation." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "4a5eb2c9bcd3577f4747cde66a2737f29f98423c3999f323e26ebc923d6d1bc0", @@ -15765,13 +13748,21 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.organization_options", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.organization_options", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/organizations", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read the enabled organizations available in the caller's ticket creation and editing interface." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -15782,28 +13773,32 @@ "description": "Read the enabled organizations available in the caller's ticket creation and editing interface." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "4024f8cd09003240dbd631a6803c065799136df882cd96874dcde8032a3b9c39", "currentRequestSchemaSha256": "4024f8cd09003240dbd631a6803c065799136df882cd96874dcde8032a3b9c39", - "newRequestProperties": [ - "module" - ], + "newRequestProperties": [], "effect": "read", "authority": "Current ticket module permissions and enabled organizations; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.request_worklogs", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.request_worklogs", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/requests/{requestId}/worklogs", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read authorized request worklog records and their stored effort." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -15814,28 +13809,32 @@ "description": "Read authorized request worklog records and their stored effort." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c6c6bbd6134b72be550af66ed3ed037436f9da264d6d1184cc7cd78e71f57fff", "currentRequestSchemaSha256": "c6c6bbd6134b72be550af66ed3ed037436f9da264d6d1184cc7cd78e71f57fff", - "newRequestProperties": [ - "requestId" - ], + "newRequestProperties": [], "effect": "read", "authority": "Parent request visibility; internal notes require staff scope; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.search_assignees", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.search_assignees", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/ticketing/assignees/search", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Search bounded eligible assignees, including saved external support coverage. Use the returned eligible identity in confirmed assignment actions." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -15846,31 +13845,32 @@ "description": "Search bounded eligible assignees, including saved external support coverage. Use the returned eligible identity in confirmed assignment actions." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "9e7daf4caddc9c84a7650b245f0104327410883b1c4a0c58c083c239b57687ed", "currentRequestSchemaSha256": "9e7daf4caddc9c84a7650b245f0104327410883b1c4a0c58c083c239b57687ed", - "newRequestProperties": [ - "limit", - "module", - "organizationId", - "q" - ], + "newRequestProperties": [], "effect": "read", "authority": "Manager of the selected ticket module and organization; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.self_service_tasks", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.self_service_tasks", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "GET", + "pathTemplate": "/api/v1/self-service/requests/{requestId}/tasks", + "effect": "read", + "readOnly": true, + "confirmationRequired": false, + "description": "Read task progress through the same owned-request and released-form audience rules as the self-service interface." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "GET", @@ -15881,28 +13881,32 @@ "description": "Read task progress through the same owned-request and released-form audience rules as the self-service interface." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "c6c6bbd6134b72be550af66ed3ed037436f9da264d6d1184cc7cd78e71f57fff", "currentRequestSchemaSha256": "c6c6bbd6134b72be550af66ed3ed037436f9da264d6d1184cc7cd78e71f57fff", - "newRequestProperties": [ - "requestId" - ], + "newRequestProperties": [], "effect": "read", "authority": "SelfService.User and current customer/form audience, or HelpdeskAdmin; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.set_customer", - "catalogStatus": "added", - "baselineOperationKey": null, - "baselineContract": null, + "catalogStatus": "retained", + "baselineOperationKey": "helpdesk_tickets.set_customer", + "baselineContract": { + "requestContract": "OperatorRequest", + "method": "POST", + "pathTemplate": "/api/v1/{ticketType}/{ticketId}/customer", + "effect": "write", + "readOnly": false, + "confirmationRequired": true, + "description": "Set a requester only on a ticket without one, using an enabled customer in the same organization. Read the ticket afterward to verify the saved requester." + }, "currentContract": { "requestContract": "OperatorRequest", "method": "POST", @@ -15913,24 +13917,18 @@ "description": "Set a requester only on a ticket without one, using an enabled customer in the same organization. Read the ticket afterward to verify the saved requester." }, "changes": {}, - "requestSchemaChanged": true, - "requestSchemaChangedPointers": [ - "/" - ], - "baselineRequestSchemaSha256": null, + "requestSchemaChanged": false, + "requestSchemaChangedPointers": [], + "baselineRequestSchemaSha256": "0b6d205306b8804b8c7a2542a0f7eb9cca749e3c66dccbd4718a9ada40194509", "currentRequestSchemaSha256": "0b6d205306b8804b8c7a2542a0f7eb9cca749e3c66dccbd4718a9ada40194509", - "newRequestProperties": [ - "body", - "ticketId", - "ticketType" - ], + "newRequestProperties": [], "effect": "write", "authority": "Manager of the parent ticket's organization and module; existing API identity, tenant and record-specific checks apply", "boundedIntegrationCredential": { "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_tickets.timeline_count", @@ -15954,21 +13952,7 @@ "confirmationRequired": false, "description": "Count timeline entries." }, - "changes": { - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "84e42ec6b74cfa2b7498961794065d826723466c009eaecb6dc942c57e97a9ae", @@ -15980,7 +13964,7 @@ "support": "permission_and_organization_intersection", "reason": "API checks account state, expiry, revocation, credential purpose/resource, granted permissions and organization scope." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_users.by_email", @@ -16004,30 +13988,7 @@ "confirmationRequired": false, "description": "by_email operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "0bb0d7ee9731ce29504d8a89418f56e7a9ab13fe5e762ef116b4c7c4323d520d", @@ -16039,7 +14000,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_users.get", @@ -16063,30 +14024,7 @@ "confirmationRequired": false, "description": "get operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "d1c4024d60b213ec4e2072e164eb1714a4f8a3b5d81bda60215600b40dd113d3", @@ -16098,7 +14036,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" }, { "operationKey": "helpdesk_users.list", @@ -16122,30 +14060,7 @@ "confirmationRequired": false, "description": "list operation." }, - "changes": { - "credentialModes": { - "old": [ - "explicit external Authentik identity satisfying HelpdeskAdmin" - ], - "new": [ - "explicit mcp-owner resource-bound grant from a current instance administrator (HTTP gateway)", - "explicit external Authentik identity satisfying HelpdeskAdmin" - ] - }, - "ownerAdministrationCredential": { - "old": null, - "new": { - "purpose": "mcp-owner", - "grantKind": "owner-administration", - "support": "subject_to_current_owner_authority_and_domain_prerequisites", - "reason": "Separate explicit administrator consent creates a resource-bound owner grant. The API revalidates the owning account's current administrator authority, credential expiry/revocation and MCP resource on each call; ordinary tenant grants never gain this authority." - } - }, - "sensitiveResultFields": { - "old": null, - "new": [] - } - }, + "changes": {}, "requestSchemaChanged": false, "requestSchemaChangedPointers": [], "baselineRequestSchemaSha256": "41db0a8c8fe1dcaa9ccb792f5997ae42eac8db95a9c17637fc78923fc3914082", @@ -16157,7 +14072,7 @@ "support": "denied_by_policy", "reason": "HelpdeskAdmin is instance-wide authority. Assignable scoped grants do not confer it; use an explicitly supported administrator identity." }, - "campaignOutcome": "requires_fresh_beta8_operator_evidence" + "campaignOutcome": "requires_fresh_beta11_operator_evidence" } ] } diff --git a/docs/implementation/0.1.2-beta.11-mcp-regressions.md b/docs/implementation/0.1.2-beta.11-mcp-regressions.md new file mode 100644 index 00000000..ce318358 --- /dev/null +++ b/docs/implementation/0.1.2-beta.11-mcp-regressions.md @@ -0,0 +1,26 @@ +# Beta.11 regression and acceptance map + +The owner-provided beta.10 campaign at source +`f60369832c553b8449d12b61c8bb024172736ebe` remains NOT_READY. Its 389 operation +rows include 152 targeted passes and additional partial observations; those +observations are historical and do not populate the new beta.11 receipt. + +| Finding | Owning change | Source verification | Fresh laptop evidence | +| --- | --- | --- | --- | +| Chunk framing consumes the server body limit; declared oversize resets | Shared decoded-body guard at MCP and Web/YARP; finite wire budget; bounded buffering/concurrency | Real Kestrel direct/proxied sockets on both routes, below/at/above cap, fragmented chunks, Expect 100-continue and duplicate controls | Public ingress matrix from `campaign_transport.py`, exact deployed source before/after and structured 413 | +| No supported inbound-rule deletion | Existing administrator API and confirmed `delete_rule` operation | API absence and retained log rows; owner/ordinary gateway tests; exact typed adapter route | Owned rule preview, confirmed deletion, API/list absence, ordinary denial and retained processing history | +| Receipt validation still bound to beta.8 | Current-release adapter over unchanged historical gate | Complete synthetic current receipt and rejection regressions; unchanged historical tests | Fresh 390-operation, 103-case, 86-obligation receipt validated against actual manifest/catalog | +| Stale selectors and response assumptions obscure read evidence | Same-run independently asserted fixture discovery; narrowly bounded SLA counter tolerance | Discovery, malformed/missing selector, parity and capture regressions | Current owned fixtures and raw MCP/API readbacks; no historical selector replay | +| Mail/approval visible state does not prove effect cardinality | Exact effect-set and provider-receipt requirements in current validator | Positive and missing/duplicate-effect gate regressions | Before/after/replay durable outbox keys/counts and independent direct-send delivery | +| Ordinary NetRatel definition deletion removes history | Companion NetRatel issue #410 | Companion migration, admission fence, retained run/name and tenant tests | Fresh owned success/failure history remains readable after definition retirement on the pinned companion | + +The [laptop campaign](../mcp-http/beta11-laptop-campaign.md) specifies prerequisite +preparation, fixture lifecycle, incremental evidence mapping, callback transport +retry versus job retry, cleanup and the final read-only soak. Missing provider +credentials, an offline target, invalid assignment coverage, an edit-locked +change and manual-task retry restrictions retain their actual classifications. + +Source tests, PR/main CI, public distribution and deployed business acceptance +are recorded separately. The publication receipt supplies actual final commit, +checksums, image digests and workflow links. The live acceptance tracker remains +[#219](https://github.com/BostonTechnologies/RatelDesk/issues/219). diff --git a/docs/implementation/README.md b/docs/implementation/README.md index 5bf6a3dc..e58ba7f6 100644 --- a/docs/implementation/README.md +++ b/docs/implementation/README.md @@ -18,3 +18,4 @@ guidance is linked from the [documentation index](../README.md). - [0.1.2-beta.9 finding repairs and live retest handoff](0.1.2-beta.9-mcp-regressions.md) - [0.1.2-beta.10 repair regression map and live retest handoff](0.1.2-beta.10-mcp-regressions.md) +- [0.1.2-beta.11 transport/lifecycle regression map and executable laptop gate](0.1.2-beta.11-mcp-regressions.md) diff --git a/docs/integrations/mailbox-ingestion.md b/docs/integrations/mailbox-ingestion.md index 05001540..e23b3bc6 100644 --- a/docs/integrations/mailbox-ingestion.md +++ b/docs/integrations/mailbox-ingestion.md @@ -62,6 +62,14 @@ When a failed email belongs to a support notification, retry moves both its emai ## Rule scope and source binding +Instance administrators can delete an explicitly selected rule through +`DELETE /api/v1/inbound-email-rules/{id}` or the confirmed MCP +`helpdesk_email_settings.delete_rule` operation. A successful deletion returns +204; subsequent detail reads return 404 and the rule is absent from rule lists. +Message processing audit rows retain the original rule ID and outcome. Deletion +does not cancel or replay already started message work, alter the shared worker, +or remove other rules. Ordinary organization credentials cannot administer rules. + Tenant rules run before global fallback rules, with priority and stable tie-breaking within each tier. **All eligible mailboxes** preserves reusable rules. A source binding restricts eligibility; it does not change priority or grant tenant authority. Global rules may target a dedicated source; a tenant cannot target another tenant's dedicated source. Reordering operates within one scope/organization/source bucket. Explicit priorities determine how different buckets interleave. The forwarded-support template remains disabled until explicitly enabled. Parsing a forwarded body records only a candidate requester; it never changes the ordinary fallback requester. An applicable rule must resolve the candidate organization, authorize the outer support sender for that organization, and validate the actual mailbox source for that target before substitution. A specialized authorized rule may resolve an outer-contact ownership conflict or the outer contact's dedicated-mailbox restriction; disabled or inapplicable rules retain the ordinary hold. Cross-tenant references, blocked senders and a candidate using the wrong source remain terminal holds. A denied operation is held and cannot fall through to equivalent ticket creation. Authorized forwarded incidents preserve their original requester and New/Unassigned behavior without the ordinary new-requester confirmation. Ownership conflicts, ambiguous routing and unconfident requester parsing require review. Existing customers are never moved between organizations by ingress. diff --git a/docs/mcp-http/beta11-laptop-campaign.md b/docs/mcp-http/beta11-laptop-campaign.md new file mode 100644 index 00000000..e917e16b --- /dev/null +++ b/docs/mcp-http/beta11-laptop-campaign.md @@ -0,0 +1,400 @@ +# RatelDesk beta.11 laptop acceptance campaign + +Run this campaign on the operator's laptop after the owner deploys +**0.1.2-beta.11**. Use the published release manifest and the checkout at its exact +source revision. This is an execution and evidence handoff for the released +product. Keep implementation work, pull requests and release publication outside +this laptop campaign. + +The scope is **390 released operations, 103 domain cases, 86 historical obligations +and nine cleanup assertions**. Beta.11 retains every beta.10 operation and adds +`helpdesk_email_settings.delete_rule`. The authoritative schemas are the released +[catalog](../contracts/mcp-operation-catalog.json); the substantive case assertions +are the immutable [campaign contract](../../tools/ci/beta8-campaign-contract.json). +The [beta.11 validator](../../tools/ci/validate-beta11-campaign.py) reuses that +contract with current release identity, exact operation preservation, deliberate +HTTP body-limit responses and stronger mail/approval effect accounting. + +## 1. Open a fresh private workspace and preserve the existing profile + +Use the exact existing RatelDesk owner HTTP-MCP configuration. Resolve its explicit +resource URI and approved credential reference locally; do not discover credentials +from unrelated CLI, browser, NetRatel or deployment profiles. Keep the credential +in a separate protected file and use the [read-harness profile format](campaign-testing.md#run-selected-live-read-checks). +Use a separate ordinary scoped actor, designated approver, and customer actor as +required by each case. Preserve previous beta evidence as read-only history. + +From PowerShell in the checkout at the released source revision, using Python +3.11 or later: + +```powershell +$Repo = (Resolve-Path .).Path +$Catalog = Join-Path $Repo "docs\contracts\mcp-operation-catalog.json" +$CampaignParent = Join-Path $env:USERPROFILE "Documents\RatelDesk-Campaigns" +New-Item -ItemType Directory -Force $CampaignParent | Out-Null +$Campaign = Join-Path $CampaignParent ("beta11-" + (Get-Date -Format "yyyyMMdd-HHmmss")) +py -3 tools/ci/validate-beta11-campaign.py init --catalog $Catalog --output $Campaign +py -3 -m venv (Join-Path $Campaign "python") +$Python = Join-Path $Campaign "python\Scripts\python.exe" +& $Python -m pip install -r tests/http_mcp/requirements.txt +``` + +`init` refuses an existing directory and creates `receipt.json`, +`prerequisites.json` and `fixture-registry.json`. All operations start `NOT_RUN`. +Set the new campaign ID and declared latency budget before execution. Copy the +independently downloaded manifest into `release/release-manifest.json` below the +campaign directory and retain its published checksum. Verify Windows x64 CLI and +stdio archives, their fresh-process version/source output, and all three deployed +image digests. Record the observed authentication mode and live `tools/list` and +capabilities against the exact released catalog. Stop a version mismatch lane +until the intended deployment is on the published identity; keep other completed +evidence intact. + +The working schema revisions are `2026-10-25.beta11-contracts-v25` and 37 tools. +Use the actual released catalog and schema hashes; never copy beta.9/beta.10 hashes +into the beta.11 receipt. + +## 2. Resolve prerequisites before the broad mutation campaign + +Complete every row in `prerequisites.json` with fresh bounded observations, hashed +evidence references and typed assertions. The checklist does not issue credentials, +grant permissions, start a worker, send mail or create a provider job. Use the +supported product workflows to prepare the exact owned fixtures and then record +their verified state. + +| Prerequisite | Required observation | +| --- | --- | +| Release and authority | Exact source/version/digests/catalog, explicit current owner grant, ordinary actor remains scoped, independent API/storage read access. | +| Baseline | Current settings, selected unrelated-record baseline, fixture registry, mail queue and provider job baseline. | +| Mail | Owner-reviewed isolation/disposition of unrelated due work before global-sender activation; a ready effective **global** sender, owned captured recipient distinct from the sender, and approved independent storage/provider readback. Pausing incoming mail does not pause outbound dispatch. A mailbox `send_test` receipt alone does not establish direct-send readiness. | +| NetRatel | Exact paired tenant and online target, independently read current target profile/revision, durable tenant visibility and admitted bounded policy, healthy protected M2M identity. Authentication alone is insufficient. Use current credentials and expiry observations. | +| NetClaw | Actual running daemon identity, saved pairing authenticates, real configured provider can produce a durable reply. Retain a corrected working endpoint instead of restoring an obsolete address. | +| Graph dataset | Approved configured Graph fixture with the permissions required for the actual dataset sync case. | +| Customer authentication | Local account/reset fixtures in Local mode; authorized external-provider fixtures in Authentik mode. Use the fixed Local guard/equivalent rules below. | +| Callback transport fixture | Owner-supplied receiver/ingress controls limited to the owned correlation and phase, preserving the approved paired origin, callback path and authentication. Current job authority does not supply a callback fault fixture. | + +```powershell +& $Python tools/ci/validate-beta11-campaign.py check-prerequisites --catalog $Catalog --prerequisites (Join-Path $Campaign "prerequisites.json") --evidence-root $Campaign +``` + +Each `READY` prerequisite needs all its named assertions, real evidence and +`expected: true`. Keep missing resources as `BLOCKED_PREREQUISITE`, with exact +affected cases and the next action. Continue independent lanes while resolving +them. Do not manufacture an owner policy by broadening a credential or treating a +browser administrator session as native MCP delegation admission. + +For **Local** authentication, the five external-identity operations retain their +documented guard plus positive local-equivalent requirements. They are not passed +by inventing an Authentik account: + +| External operation | Required positive Local equivalent | +| --- | --- | +| `provision_user` | `create_local_account` | +| `customer_invite` | `create_local_account` or `reset_customer_login` | +| `customer_resend_invite` | `reset_local_account` or `reset_customer_login` | +| `customer_disable_login` | `disable_local_account` | +| `customer_sync_authentik` | `auth_status` or `reset_customer_login` | + +The exact qualified IDs and historical mapping rules remain in the validator. +HTTP `helpdesk_config.set` and `.unset` are separately expected restrictions. The +other operations retain their positive requirements, including Graph and native +AI/provider effects. Preserve earlier blockers as historical observations. + +### Prepare direct-mail delivery on the intended target + +The outbound dispatcher runs independently of the incoming mailbox worker and +processes the shared due queue automatically. Incoming pause is not an outbound +hold, and there is no supported public "dispatch only this outbox ID" command. +Before enabling or changing the global sender, have the owner establish an +approved quiet window or isolation and disposition of unrelated due/in-flight +work. Preserve the intended target and sender baseline; do not create isolation +by cancelling unrelated deliveries or redirecting their sender. If these +conditions are unavailable, keep the delivery lane blocked and continue ready +independent work. + +Send the one owned direct-mail fixture through the normal confirmed operation, +then observe ordinary dispatch. Its queued response does not contain the outbox +ID. Require approved read-only storage and provider capture access to find the +exact effect using its unique subject, recipient and sender, then prove its +delivery. [Pending Emails](../integrations/mailbox-ingestion.md#pending-delivery-queue) +actions address ticket/timeline deliveries; do not pass a ticketless direct +outbox ID to those actions. Preserve a historical `NeedsReview` direct effect +with its recorded uncertainty and operator disposition; do not invent a retry, +edit its database state or infer nondelivery from its continued presence. + +### Resolve exact NetRatel reviewed admission + +The bounded auxiliary credential retained by the preceding campaign expired on +**25 October 2026 at 08:00 UTC (10:00 SAST)**. Record its current lifecycle; prepare +an approved current auxiliary credential through the protected client flow. Keep +its selected grants, canonical resource, instance/environment, exact expiry and +consumer profile explicit. A replacement does not change the primary consumer. + +Use the existing reviewed-access workflow in the pinned NetRatel +`v0.1.1-beta.48` source: `docs/mcp-http/setup.md` ("Reviewed client access and +exact expiry"), `docs/mcp-http/local-credential-mode.md` ("Reviewed admission") +and `docs/mcp-http/authentication.md`. +Beta.48 supplies the definition-retirement/history repair; it does not introduce +a bypass for these existing authority requirements. + +1. Inspect the current caller-owned credential with `netratel_access/credential`. + Record configured grants, exact UTC expiry, canonical resource and current + durable owner permissions separately from the scope shown for a status call. +2. Resolve the exact persisted tenant/agent from the retained mapping and verify + that agent is online. Read its current server-owned target profile using an + already authorized owner: `netratel_access/target` and `/effective` accept + `{tenantId, agentId}`. The authorized policy-administration account read + `GET /api/v2/mcp-operator/targets/{tenantId}/{agentId}` also exposes the persisted + profile and its `version`. Use that current version as `profileRevision`. + Missing discovery authority remains a precise prerequisite; it is not a reason + to add unrelated grants to the disposable job credential or omit the revision. +3. Inspect the exact desired operations through + `POST /api/v2/account/integration-credentials/{credentialId}/admission` with + `targets` containing `tenantId`, `tool`, `operation`, `agentId` and + `profileRevision`. This owner-account call is read-only and does not install a + policy. Do not infer jobs admission from the default flow-read samples. +4. When reconciliation is needed, prepare one durable request UUID with the exact + selected grants, instance permissions, future reviewed expiry and operation + targets. Preserve the returned request receipt and proposal hash. A new + credential's creation starts with the protected setup client (`access prepare` + or the validated Windows DPAPI wrapper) so its secret stays in protected + one-time delivery, rather than model-visible tool output. +5. An existing authorized owner with current `mcp.policy.admin`, the required MCP + administrator delegation and every selected durable permission may call + `netratel_access` with `operation: owner_apply` and + `request: {requestId, proposalHash, confirm: true}`. The hash is the exact + 64-character value in that pending receipt. This produces `owner_direct`; + it does not add administrator authority to its caller. Otherwise use the + supported authorized browser review of that same prepared request. Protected + polling/resume completes creation and stores the new credential in its own + profile. Reconcile an interrupted outcome using the same request ID before + retrying; changed targets, bounds or expiry require a new proposal. +6. Refresh the exact admission, then perform permitted native reads on the + intended tenant/agent and inspect runtime readiness before owned execution. + Current authentication, tenant visibility, policy admission and online runtime + are separate observations. Preserve unrelated-tenant denial. + +The **Admin → MCP Policies** lifecycle UI is a different route: its operator needs +an independently assigned active bounded parent policy allowing +`PolicyAdministration` for the exact environment/tenant/target. It cannot create +its own authorizing parent. An absent parent in that lifecycle UI does not mean +the already-authorized owner's reviewed `owner_apply` path should be replaced by +repeated lifecycle previews. Use the applicable supported route with its actual +prerequisites and retain the receipt's approval mode. + +## 3. Build current owned fixtures and acquire selectors independently + +Record each fixture's campaign marker, type, exact ID, organization, creation +request/response, independent readback, dependencies and final disposition in +`fixture-registry.json`. Record baseline settings and exact restoration values +before changing them. A retained fixture is reusable only after current identity, +scope and lifecycle readback proves it is suitable for this case. + +Use a unique marker and current list/search to acquire each selector. The +[discovery plan](../../tests/http_mcp/read-plan-discovery.example.json) resolves +`${ownedIncident.id}` only from same-run MCP and independent API reads after +count/marker assertions. Copy it into the private workspace, replace the unique +subject marker, then run: + +```powershell +& $Python tests/http_mcp/campaign_reads.py --catalog $Catalog --plan (Join-Path $Campaign "read-plan.json") --profile (Join-Path $Campaign "profile.json") --output (Join-Path $Campaign "reads-001") +``` + +Keep the fixture conditions precise: + +- Assignments need an enabled technician with exact support-group membership and + customer-organization coverage. For caller-bound self-assignment, use a fixture + in the authenticated actor's covered organization and test incident, request + and change separately. +- Detail edits and assignment on changes need a Draft when that lifecycle requires + it. A complete Normal change may already be approved and locked. +- Positive single and bulk retries need eligible **failed automation tasks**. + Failed manual tasks are not retry fixtures. Preserve the first terminal attempt + and require distinct execution IDs after retry. +- Designated approvers must be distinct real observed actors. Administrative + ownership does not imply authority to impersonate an approver. +- Archive and soft-delete contracts need inactive/archived state readback. Where + direct GET is unsupported, use the supported filtered list to prove absence. + +For sequential incident reads, an explicit `slaCountdownToleranceSeconds` of at +most five permits only the two live SLA counters described in the canonical +guide. All raw captures and stable fields remain exact. Provider definitions use +the published `requestDefinitionName` field; inspect schemas before evaluating +an envelope or property name. + +## 4. Execute and reconcile each lane as it completes + +Run the historical repaired notification/list/timeline lanes first, then complete +the full catalog and domain workflows using the dependency registry. For every +applicable write capture unchanged preview, one confirmed MCP request, independent +durable effect and the ordinary-denial check where required. A preview, HTTP 200, +empty list, denial, `updated:0` or an unchanged row cannot replace a positive +business effect. API fixture setup does not count as MCP execution coverage. + +Map each completed case into all operation, domain and historical requirements +that its actual assertions prove. Reuse one valid case across explicit mappings +instead of replaying the same destructive fixture to increase a count. References +in the final receipt are relative to the campaign root and include SHA-256 hashes; +rebase nested harness references when importing supporting read summaries. + +```powershell +& $Python tools/ci/validate-beta11-campaign.py status --catalog $Catalog --receipt (Join-Path $Campaign "receipt.json") +``` + +`status` lists exact missing mappings and never validates recorded PASS labels. +Keep mapping while working; do not defer all 103 domain and 86 historical +reconciliations until the end. + +### HTTP body boundary and duplicate validation + +Run against the same released public ingress used by the owner MCP profile: + +```powershell +& $Python tests/http_mcp/campaign_transport.py --profile (Join-Path $Campaign "profile.json") --manifest (Join-Path $Campaign "release\release-manifest.json") --evidence-root $Campaign --output (Join-Path $Campaign "transport-boundary") +``` + +Import the printed `transportBoundary` reference into `receipt.json`. The runner +checks 13 real requests at the default 30,000,000 decoded-byte cap: both routes, +both framing forms, one byte below/at/above, plus the reported chunked regression +size. Below/at must initialize successfully; above must return deliberate HTTP +413 with `code: request_too_large`, `limit: body` and the effective byte cap. +If the deployment intentionally uses a smaller cap, pass `--limit`, retain its +fresh configuration capture in `transportLimitConfiguration`, and test that cap. +Connection resets, proxy HTML and a smaller unexplained streamed boundary fail. + +Retain the ~1.1 MB duplicate outer/inner member tests across both routes/framing +and Windows stdio, valid controls, original RPC IDs, structured validation errors +and no owned mutation. Separately check oversized declared-length +`Expect: 100-continue` behavior before upload. Source socket tests are supporting +implementation evidence; capture the deployed ingress results independently. + +### Direct mail and approval effect cardinality + +Capture before/first/replay effect snapshots from independent storage or the +supported effect API. Each normalized snapshot has this shape, with its actual +query and raw source receipt retained separately: + +```json +{ + "observedAt": "2026-10-25T12:00:00Z", + "scope": {"campaignId": "synthetic-campaign", "correlation": "unique-owned-effect-marker"}, + "effects": [{"id": "observed-effect-id", "effectKey": "observed-durable-effect-key"}] +} +``` + +Put `effectCardinality` in the corresponding case receipt: + +```json +{ + "expectedNewEffects": 1, + "before": {"path": "effects/before.json", "sha256": "actual-sha256"}, + "first": {"path": "effects/first.json", "sha256": "actual-sha256"}, + "replay": {"path": "effects/replay.json", "sha256": "actual-sha256"} +} +``` + +For direct `helpdesk_mail.send`, omit `replay`: require exactly one new selected +outbox effect, durable queue/history readback and independently captured provider +delivery to the exact owned recipient. Its postcondition must include +`direct_send_delivery_matches_effect` and both `storage` and `transport_capture` +surfaces. A successful mailbox `send_test` is a separate operation. + +For `support.concurrent_approval_decisions`, predeclare the expected first-decision +effect count for the configured fixture. Capture winning decision state, effect +IDs/keys and the same set after replay/concurrency. The validator compares exact +effect sets, not only totals. Resolve every uncertain response by independent +readback before considering another external action. Record an explicit supported +disposition for retained uncertain mail without assuming nondelivery or flushing +unrelated work. + +### Foreign notification no-op and new rule deletion + +A foreign personal mark-read returning `success:true, updated:0` can prove expected +isolation when exact independent before/after records show no change. It cannot +prove a positive owner write. Such an expected-negative case must retain the actual +confirmed request/response and an `isolationReadback` containing `ownerActor` +(a different observed actor), `before` and `after` capture references. Those captures +contain ordered `observedAt` and the same full `body` notification with its selected +`id`. Require `other_actor_read_marker_unchanged` and both API/storage evidence. +Use a separate owned notification to prove positive mark-read. + +For `helpdesk_email_settings.delete_rule`, create an owned narrow disabled rule. +Preview must leave it unchanged; owner confirmation must remove only that rule; +ordinary confirmation must be forbidden. Verify missing-by-ID/list absence and +preservation of existing processing audit logs referencing the deleted rule. This +operation uses `DELETE /api/v1/inbound-email-rules/{ruleId}` and does not require +starting the mail worker or sending a message. + +### Paired transport, history and AI recovery + +Prove provider success, controlled job failure, single/bulk eligible retry, +duplicate callback, incorrect binding and terminal ordering. Then test an owned +callback's transient HTTP 5xx retry and terminal rejection separately. Capture +exact request/task/binding/correlation, provider run and delivery-attempt state, +RatelDesk attempt state and cardinality. A failed job followed by successful retry +does not substitute for HTTP callback retry evidence. + +The HTTP-failure cases require an owner-supplied controlled receiver/ingress +fixture, with documented activation, restoration and sanitized request capture. +It must select the exact owned correlation and callback phase at the approved +paired origin and `/api/v1/orchestration/provider/callback`, preserve normal +authentication/token exchange, and leave other traffic unchanged. The product +does not expose a production fault toggle or arbitrary callback-URL override. +Do not assume the laptop agent can create production ingress controls. Without +this fixture, record the precise prerequisite and keep these cases unpassed. + +Use separate owned cases for a planned HTTP 503 followed by normal callback +acceptance and for a terminal HTTP 403. Capture the actual receiver HTTP attempts; +durable delivery-attempt counts are not counts of internal HTTP retries. For a +later-tick recovery assertion, the owner must hold the scoped transient response +through the initial retry window, then restore normal handling. After terminal +rejection, verify the retained rejected state and no further automatic delivery +across ordinary reconciliation. Repair the fixture before explicit replay. An +already admitted Events ControlPlane actor can locate the exact event using +`eventType` and `correlationId`, check `retryTarget: external-service-callback`, +and use `netratel_events/preview_retry` followed by `retry` with the unchanged +`eventId`, `planToken`, `idempotencyKey` and outer `confirm: true`. Job-execution +authority alone does not authorize these event controls. A published notification +is not a delivered callback; require the receiver effect and durable delivery +readback, including no duplicate effect after replay. + +After deleting an owned completed provider definition, verify that terminal run +history remains readable through supported provider APIs/UI. Distinguish row +retention from a broken lookup through a deleted definition. Keep source repairs +and current live prerequisites separate. If the companion version changes, +revalidate affected lanes on the final version rather than pooling incompatible +segments into one pass. + +For native AI, keep actual conversation, turn, message and interaction IDs; prove +reply, offered response, uncertainty reconcile, stop-waiting and acknowledged +abandon on eligible real states. An idle chat or synthetic webhook save cannot +substitute for provider dispatch and recovery effects. + +## 5. Finish functional evidence, then soak, cleanup and validate + +Set `functionalCompletedAt` only when applicable operation/domain/history mappings +and the required repair lanes are complete. Run the canonical read-only soak for +900–3,600 seconds after that point, with fresh RPC IDs, 30–10,000 unique captures, +no unobserved interval over 60 seconds, no unexpected failures and p95 within the +budget declared before campaign start. Preserve the exact final release identity. + +Complete the nine canonical cleanup assertions after the soak: unrelated records, +temporary credential revocation, stopped temporary jobs, restored mailbox/worker/ +sender, preserved terminal history, reconciled uncertain effects, every fixture's +disposition, excluded secrets and restored administration settings. Register +intentional permanent repairs and product soft-delete retention explicitly. + +The final receipt's case assertions and evidence surfaces follow the existing +[acceptance contract](../implementation/0.1.2-beta.8-campaign.md). Set `readiness` +to `PASS` only as a candidate for complete validation; the command rejects missing +or inconsistent evidence: + +```powershell +& $Python tools/ci/validate-beta11-campaign.py validate --catalog $Catalog --manifest (Join-Path $Campaign "release\release-manifest.json") --receipt (Join-Path $Campaign "receipt.json") --evidence-root $Campaign +``` + +Return the validator output, a human-readable report, exact residual IDs if any, +operation/domain/history mapping, prerequisite status, fixture disposition and a +curated private evidence archive. Keep the actual measured result. Source tests, +release publication and supporting read sweeps remain separate from deployed +production acceptance. diff --git a/docs/mcp-http/campaign-testing.md b/docs/mcp-http/campaign-testing.md index b7a46e88..26867924 100644 --- a/docs/mcp-http/campaign-testing.md +++ b/docs/mcp-http/campaign-testing.md @@ -1,6 +1,12 @@ # Repeatable HTTP MCP campaign checks -For beta.9, the runner independently adapts the workflow metrics API's explicit +For the current release, use the [beta.11 laptop campaign](beta11-laptop-campaign.md) +and its [executable workspace and receipt gate](../../tools/ci/validate-beta11-campaign.py). +It preserves all 389 prior operations, adds inbound rule deletion (390 total), +and retains the 103 domain cases, 86 historical obligations and nine cleanup +assertions. Its workspace starts entirely `NOT_RUN`; previous receipts stay unchanged. + +The read runner independently adapts the workflow metrics API's explicit Prometheus `text/plain` contract to `{format:"prometheus",text:...}`, matching MCP. Other API reads still require JSON. Include a fixture-specific `/text` assertion; for logs, assert the actual known warning in `/items/0/message` and its trace, @@ -11,10 +17,12 @@ Test a business capability through HTTP MCP, then independently observe its back state, UI or actual provider effect. API-only calls cannot establish an MCP pass. Python here is external test tooling; the application and MCP runtime remain C#. -The complete beta.8 requirements and acceptance gate remain in the -[canonical campaign guide](../implementation/0.1.2-beta.8-campaign.md), +The substantive historical requirements remain in the +[beta.8 acceptance contract guide](../implementation/0.1.2-beta.8-campaign.md), [operation catalog](../contracts/mcp-operation-catalog.json) and -[offline validator](../../tools/ci/validate-beta8-campaign.py). Retain their fixed +[immutable beta.8 validator](../../tools/ci/validate-beta8-campaign.py). The beta.11 +adapter binds the current manifest/catalog and reuses those evidence checks. +Retain their fixed denominators, mode exclusions, independent evidence, provider receipts, soak and cleanup requirements. Source CI and a subset of live reads cannot satisfy that gate. @@ -69,9 +77,50 @@ Other business records still make these captures private. Do not commit them. The runner accepts only catalog-advertised GET/read-only operations. It refuses schema drift, redirects, plaintext HTTP, missing assertions, mismatched responses and automatic retries. Its summary describes selected supporting reads, not a full -campaign receipt. Volatile responses may legitimately differ between reads; keep -the failed captures and use a dedicated case with precise durable assertions rather -than broadly ignoring changed fields. +campaign receipt. Raw observations are retained unchanged. A case may explicitly +set `slaCountdownToleranceSeconds` to an integer from 1 to 5 when sequential reads +differ only at `/sla/responseRemainingSeconds` and +`/sla/resolutionRemainingSeconds`. Both fields must be integer counters within that +tolerance; all other fields remain exact and the assertions must identify stable +fixture values. The default remains exact comparison. This does not relax SLA state, +deadline, identity, count, notification or business-effect comparisons. + +### Discover current selectors before reading dependent records + +The [discovery plan](../../tests/http_mcp/read-plan-discovery.example.json) first +selects the current campaign's uniquely named owned incident. The discovery read +must pass independent MCP/API parity and typed marker/count assertions. Only then +does `${ownedIncident.id}` resolve for later requests. References must occupy the +whole string and resolve from this run; unknown references, empty results and +non-scalar selector values fail before dependent reads. A discovery plan does not +create fixtures: first create the owned record through its confirmed MCP lane and +record it in the campaign fixture registry. Never substitute IDs copied from an +older campaign whose fixtures were deleted. + +### Probe actual HTTP framing and size boundaries + +The [transport runner](../../tests/http_mcp/campaign_transport.py) sends valid +read-only `initialize` requests on `/mcp` and `/mcp/`, using both Content-Length +and chunked framing at the decoded body limit minus one, exactly the limit, and +the limit plus one. It also rechecks the previously reported 29,990,208-byte +chunked case at the default limit. It checks the pinned API identity before and +after, captures structured 413 responses, and records transport resets as failures. +The JSON/whitespace body hash and byte count are retained without storing thirteen +large duplicate payloads. It never invokes `tools/call` or retries a failed probe. + +```sh +python tests/http_mcp/campaign_transport.py \ + --profile /private/campaign/profile.json \ + --manifest /private/campaign/release/release-manifest.json \ + --evidence-root /private/campaign \ + --output /private/campaign/transport-boundary +``` + +The default limit is 30,000,000 decoded bytes. If an independently observed +deployment configuration intentionally lowers it, pass that exact `--limit` and +record the configuration evidence. The final validator requires the complete live +matrix and configuration evidence for a smaller limit. Source socket tests do +not establish that the deployment's external ingress has the same configuration. ## Expand coverage with application capabilities @@ -106,4 +155,4 @@ python -m unittest discover -s tests/http_mcp -p 'test_*.py' ``` These synthetic offline tests verify the harness's failure boundaries. They do not -claim deployed MCP operation coverage or change the immutable beta.8 gate. +claim deployed MCP operation coverage or change historical receipts. diff --git a/docs/mcp-http/deployment.md b/docs/mcp-http/deployment.md index bedb482a..8c9c900a 100644 --- a/docs/mcp-http/deployment.md +++ b/docs/mcp-http/deployment.md @@ -362,6 +362,58 @@ In an extracted deployment archive, Compose files are at archive root: omit the `docker/` prefix and use release overlays; source builds require a checkout. Canonical guides and third-party licenses are bundled with the flat recipe. +## JSON request body limits + +`POST /mcp` and `POST /mcp/` accept up to **30,000,000 decoded body bytes** by +default, including JSON whitespace. The Web gateway and standalone HTTP MCP +host apply the same guard. A finite server `MaxRequestBodySize` configured at +either hop becomes that hop's decoded-body cap; a server with no body cap still +uses the 30,000,000-byte MCP default. The effective end-to-end limit is the +smallest limit on the deployed path. + +Content-Length and HTTP/1.1 chunked requests use the same decoded budget. This +is separate from Kestrel's transport accounting, which includes chunk prefixes, +suffixes and extensions. For these guarded posts only, the transport ceiling is +`13 × decoded limit + 65,536` bytes (390,065,536 at the default). This finite +ceiling accommodates even one-byte chunks with eight-digit size prefixes while +still bounding excessive chunk extensions. The application buffers at most one +byte beyond the decoded limit, using temporary files beyond 1 MiB. The Web +gateway forwards accepted, fully read bodies with their exact Content-Length; +MCP responses retain normal streaming behavior. Other paths keep their existing +server limits. Web admits at most 32 simultaneous guarded MCP posts, with no +waiting queue; additional posts receive HTTP 429. The lease covers the body and +its forwarded response, then releases when the request ends. + +An oversized body receives HTTP **413**, `Content-Type: application/problem+json`, +and a body such as: + +```json +{ + "type": "about:blank", + "title": "MCP request is too large", + "status": 413, + "code": "request_too_large", + "limit": "body", + "maximumBodyBytes": 30000000, + "maximumWireBytes": 390065536 +} +``` + +Exceeding the finite transport ceiling uses `"limit": "transport"`. Declared +oversize is rejected from its headers; clients using `Expect: 100-continue` can +receive the 413 before sending the body. The response is completed before the +server handles the unread upload. No MCP tool executes for a size rejection. + +When deploying behind another ingress, inspect its actual request limits and +error handling as well. Validate both public route forms with declared and +chunked valid JSON at the observed limit minus one byte, exactly the limit and +one byte over. Record the response and decoded byte count for every case. +The expected boundary is success, success, then structured 413. Repeat the +1.1 MiB duplicate-member controls to verify `validation_failed`, original RPC +IDs and no business writes. Source tests exercise real Kestrel and Web/YARP +sockets; the [campaign guide](campaign-testing.md) covers the released public +path and its independent ingress settings. + ## Migration, persistence and rotation An existing protected JSON + env_file installation remains supported. Review diff --git a/docs/release-notes/0.1.2-beta.11.md b/docs/release-notes/0.1.2-beta.11.md new file mode 100644 index 00000000..cc7b53f1 --- /dev/null +++ b/docs/release-notes/0.1.2-beta.11.md @@ -0,0 +1,52 @@ +# 0.1.2-beta.11 + +Completes the beta.10 transport and inbound-rule lifecycle repairs and supplies +an executable, current-release laptop acceptance gate. + +## Product changes + +- HTTP MCP and the public Web gateway enforce the same decoded JSON request + body limit for Content-Length and chunked uploads on `/mcp` and `/mcp/`. + The default remains 30,000,000 bytes. Oversized requests receive a structured + HTTP 413; framing has a separate finite budget. Tighter configured limits + remain effective. Buffered requests have bounded memory, disk and concurrency + use. Existing duplicate-argument validation remains in place (#266). +- Administrator inbound email rules support selected-rule deletion through + `DELETE /api/v1/inbound-email-rules/{ruleId}` and the confirmed MCP operation + `helpdesk_email_settings.delete_rule`. Processing history remains available, + and existing owner/ordinary authorization boundaries apply (#267). +- The catalog contains 37 tools and 390 operations at revision + `2026-10-25.beta11-contracts-v25`. All 389 previous operation identities are + retained; `delete_rule` is the single addition. + +## Campaign execution + +The [laptop guide](../mcp-http/beta11-laptop-campaign.md) and +[current validator](../../tools/ci/validate-beta11-campaign.py) bind evidence to +the published beta.11 source, manifest and catalog. They retain the 103 domain +cases, 86 historical obligations, nine cleanup assertions and post-functional +soak. Historical beta.8 through beta.10 receipts remain unchanged. + +New tooling acquires selectors from fresh independently verified fixtures, +tests the real HTTP framing boundary, records prerequisites before mutation +lanes, and reconciles evidence as each lane completes. Direct mail and approval +replay require exact durable effect accounting. Only the documented volatile +SLA countdown fields can receive a bounded parity tolerance. + +## Paired provider and deployment + +The accompanying NetRatel history repair is tracked by NetRatel issue #410. +Ordinary definition retirement must retain terminal run evidence for the paired +cleanup gate. Use the exact companion release recorded in the published handoff +and a fresh owned run to prove that behavior. + +The owner deploys the published artifacts; the laptop campaign then verifies +identity and executes acceptance. A ready global mail sender, isolated delivery +recipient, current bounded NetRatel authority, online execution target and real +AI/provider fixtures are explicit preflight requirements. The full live verdict +remains tracked by [#219](https://github.com/BostonTechnologies/RatelDesk/issues/219). + +Publication follows the existing hosted release workflow, immutable native and +deployment archives, checksums, manifest and three multi-architecture image +families. Delivery is tracked by +[#268](https://github.com/BostonTechnologies/RatelDesk/issues/268). diff --git a/docs/release-notes/README.md b/docs/release-notes/README.md index 94e24920..40de9103 100644 --- a/docs/release-notes/README.md +++ b/docs/release-notes/README.md @@ -1,5 +1,12 @@ # Release notes +## 0.1.2-beta.11 + +[Transport, inbound-rule lifecycle and executable laptop acceptance](0.1.2-beta.11.md) +adds consistent decoded-body limits, selected-rule deletion and a current-release +evidence gate. The [regression map](../implementation/0.1.2-beta.11-mcp-regressions.md) +links source verification to the separate deployed campaign. + ## 0.1.2-beta.10 candidate [Beta.9 campaign repair follow-up](0.1.2-beta.10.md) covers incident seen diff --git a/docs/releases/README.md b/docs/releases/README.md index 0a1b1623..911afd07 100644 --- a/docs/releases/README.md +++ b/docs/releases/README.md @@ -1,5 +1,14 @@ # Releases +## 0.1.2-beta.11 — beta.10 follow-up + +[Release notes](../release-notes/0.1.2-beta.11.md) cover HTTP body-boundary repair, +complete inbound-rule deletion and the current-release campaign tooling. +[Delivery #268](https://github.com/BostonTechnologies/RatelDesk/issues/268) requires +the existing reviewed CI and immutable hosted publication workflow. +The [laptop guide](../mcp-http/beta11-laptop-campaign.md) verifies published identity +before fresh acceptance; historical beta.10 evidence remains unchanged. + ## 0.1.2-beta.10 candidate — retained campaign repairs [Candidate notes](../release-notes/0.1.2-beta.10.md) and the diff --git a/src/HelpDesk.NewWeb/Services/WebGatewayRequestGuard.cs b/src/HelpDesk.NewWeb/Services/WebGatewayRequestGuard.cs index 250a290e..0d5d3e3f 100644 --- a/src/HelpDesk.NewWeb/Services/WebGatewayRequestGuard.cs +++ b/src/HelpDesk.NewWeb/Services/WebGatewayRequestGuard.cs @@ -1,3 +1,5 @@ +using System.Threading.RateLimiting; +using Helpdesk.ServiceDefaults; using Yarp.ReverseProxy.Model; namespace HelpDesk.NewWeb.Services; @@ -6,6 +8,12 @@ namespace HelpDesk.NewWeb.Services; public static class WebGatewayRequestGuard { public const string MetadataPath = WebGatewayPaths.MetadataPath; + private static readonly ConcurrencyLimiter McpBodyLimiter = new(new ConcurrencyLimiterOptions + { + PermitLimit = 32, + QueueLimit = 0, + QueueProcessingOrder = QueueProcessingOrder.OldestFirst + }); public static bool IsMcpPath(PathString path) => WebGatewayPaths.IsMcpPath(path.Value ?? ""); @@ -21,6 +29,26 @@ await context.Response.WriteAsJsonAsync(new { title = "MCP route is not configur options: null, contentType: "application/problem+json", cancellationToken: context.RequestAborted); return; } + if (McpRequestBody.IsJsonPost(context.Request)) + { + // Web validates before downstream MCP authentication. Bound the + // number of public requests holding memory or temporary body files. + using var lease = await McpBodyLimiter.AcquireAsync(1, context.RequestAborted); + if (!lease.IsAcquired) + { + context.Response.StatusCode = StatusCodes.Status429TooManyRequests; + await context.Response.WriteAsJsonAsync(new { title = "Too many concurrent MCP requests", status = 429, code = "too_many_mcp_requests" }, + options: null, contentType: "application/problem+json", cancellationToken: context.RequestAborted); + return; + } + if (!await McpRequestBody.BufferAsync(context)) return; + // Forward the completed body with its exact length. Incoming chunk + // framing is hop-specific and must not consume the backend budget. + context.Request.Headers.Remove("Transfer-Encoding"); + context.Request.ContentLength = context.Request.Body.Length; + await next(context); + return; + } await next(context); }); } diff --git a/src/Helpdesk.API/Endpoints/Email/InboundEmailRuleEndpoints.cs b/src/Helpdesk.API/Endpoints/Email/InboundEmailRuleEndpoints.cs index fae5049b..b0cda889 100644 --- a/src/Helpdesk.API/Endpoints/Email/InboundEmailRuleEndpoints.cs +++ b/src/Helpdesk.API/Endpoints/Email/InboundEmailRuleEndpoints.cs @@ -117,6 +117,18 @@ public static void MapInboundEmailRuleEndpoints(this IEndpointRouteBuilder app) group.MapPost("/{id}/disable", async ([FromServices] HelpdeskDbContext db, [FromRoute] string id, ClaimsPrincipal user, CancellationToken ct) => await SetEnabledAsync(db, id, false, Actor(user), ct)); + group.MapDelete("/{id}", async ([FromServices] HelpdeskDbContext db, [FromRoute] string id, CancellationToken ct) => + { + var rule = await db.InboundEmailRules.FirstOrDefaultAsync(x => x.Id == id, ct); + if (rule is null) return Results.NotFound(); + + // Processing logs retain their scalar RuleId after configuration is removed. + // Do not remove historical outcomes or replay any associated message work. + db.InboundEmailRules.Remove(rule); + await db.SaveChangesAsync(ct); + return Results.NoContent(); + }); + group.MapPost("/reorder", async ( [FromServices] HelpdeskDbContext db, [FromBody] ReorderInboundEmailRulesRequest request, diff --git a/src/Helpdesk.Mcp.Core/Tools/McpOperationCatalog.cs b/src/Helpdesk.Mcp.Core/Tools/McpOperationCatalog.cs index c0431aeb..11ad78ed 100644 --- a/src/Helpdesk.Mcp.Core/Tools/McpOperationCatalog.cs +++ b/src/Helpdesk.Mcp.Core/Tools/McpOperationCatalog.cs @@ -27,7 +27,7 @@ public sealed record McpOperationDefinition( /// public static class McpOperationCatalog { - public const string Revision = "2026-10-20.beta9-contracts-v24"; + public const string Revision = "2026-10-25.beta11-contracts-v25"; public static IReadOnlyList All { get; } = [ diff --git a/src/Helpdesk.Mcp.Core/Tools/OperatorMailSupportOperations.cs b/src/Helpdesk.Mcp.Core/Tools/OperatorMailSupportOperations.cs index 6394e211..7ad60229 100644 --- a/src/Helpdesk.Mcp.Core/Tools/OperatorMailSupportOperations.cs +++ b/src/Helpdesk.Mcp.Core/Tools/OperatorMailSupportOperations.cs @@ -106,6 +106,7 @@ private static IEnumerable EmailSettings() yield return new("helpdesk_email_settings", "update_rule", "PUT", rules + "/{ruleId}", BodyType: typeof(UpdateInboundEmailRuleRequest), RequiredBodyFields: ["scopeType", "name", "enabled", "priority", "conditions", "actions", "stopProcessing"], Description: "Replace the typed settings of one inbound email rule."); yield return new("helpdesk_email_settings", "enable_rule", "POST", rules + "/{ruleId}/enable", Description: "Enable one inbound rule after canonical binding validation."); yield return new("helpdesk_email_settings", "disable_rule", "POST", rules + "/{ruleId}/disable", Description: "Disable one inbound rule while retaining its audit history."); + yield return new("helpdesk_email_settings", "delete_rule", "DELETE", rules + "/{ruleId}", Description: "Delete one explicitly selected inbound rule while preserving its message processing audit history. Already started message work is not cancelled or replayed."); yield return new("helpdesk_email_settings", "reorder_rules", "POST", rules + "/reorder", BodyType: typeof(ReorderInboundEmailRulesRequest), RequiredBodyFields: ["rules"], Description: "Reorder an explicitly selected distinct set of rules in one tenant/mailbox scope."); yield return new("helpdesk_email_settings", "rule_audit", "GET", rules + "/audit", QueryType: typeof(OperatorMailRuleAuditQuery), Description: "Read up to 200 inbound rule processing outcomes filtered by ticket, message, tenant or mailbox."); diff --git a/src/Helpdesk.Mcp.Http/McpDuplicateArgumentsMiddleware.cs b/src/Helpdesk.Mcp.Http/McpDuplicateArgumentsMiddleware.cs index 73b472e5..27ec48ca 100644 --- a/src/Helpdesk.Mcp.Http/McpDuplicateArgumentsMiddleware.cs +++ b/src/Helpdesk.Mcp.Http/McpDuplicateArgumentsMiddleware.cs @@ -1,62 +1,21 @@ using Helpdesk.Mcp.Tools; -using Microsoft.AspNetCore.Http.Features; +using Helpdesk.ServiceDefaults; namespace Helpdesk.Mcp.Http; /// Validates duplicate argument envelopes before the MCP SDK binds HTTP requests. public sealed class McpDuplicateArgumentsMiddleware(RequestDelegate next) { - private const int MemoryThreshold = 1_048_576; - private const long DefaultMaximumBodyBytes = 30_000_000; - public async Task InvokeAsync(HttpContext context) { var request = context.Request; - if (!string.Equals(request.Path.Value?.TrimEnd('/'), "/mcp", StringComparison.OrdinalIgnoreCase) || - !HttpMethods.IsPost(request.Method) || - request.ContentType?.StartsWith("application/json", StringComparison.OrdinalIgnoreCase) != true) + if (!McpRequestBody.IsJsonPost(request)) { await next(context); return; } - // Content-Length is optional with streamed HTTP bodies. Inspect the entire - // accepted body, using the server's finite limit or its normal default. - var maximumBytes = context.Features.Get()?.MaxRequestBodySize - ?? DefaultMaximumBodyBytes; - if (request.ContentLength > maximumBytes) - { - context.Response.StatusCode = StatusCodes.Status413PayloadTooLarge; - return; - } - - var bufferingLimit = maximumBytes < long.MaxValue ? maximumBytes + 1 : maximumBytes; - request.EnableBuffering(bufferThreshold: MemoryThreshold, bufferLimit: bufferingLimit); - var buffer = new byte[8192]; - long inspectedBytes = 0; - try - { - while (true) - { - var remaining = maximumBytes - inspectedBytes; - var readLength = remaining < buffer.Length ? (int)remaining + 1 : buffer.Length; - var count = await request.Body.ReadAsync(buffer.AsMemory(0, readLength), context.RequestAborted); - if (count == 0) break; - inspectedBytes += count; - if (inspectedBytes > maximumBytes) - { - context.Response.StatusCode = StatusCodes.Status413PayloadTooLarge; - return; - } - } - } - catch (BadHttpRequestException error) when (error.StatusCode == StatusCodes.Status413PayloadTooLarge) - { - context.Response.StatusCode = StatusCodes.Status413PayloadTooLarge; - return; - } - - request.Body.Position = 0; + if (!await McpRequestBody.BufferAsync(context)) return; var normalized = await McpDuplicateArgumentsGuard.NormalizeAsync(request.Body, context.RequestAborted); request.Body.Position = 0; if (normalized is not null) diff --git a/src/Helpdesk.ServiceDefaults/McpRequestBody.cs b/src/Helpdesk.ServiceDefaults/McpRequestBody.cs new file mode 100644 index 00000000..1807086e --- /dev/null +++ b/src/Helpdesk.ServiceDefaults/McpRequestBody.cs @@ -0,0 +1,93 @@ +using System.Buffers; +using System.Text.Json; +using Microsoft.AspNetCore.Http; +using Microsoft.AspNetCore.Http.Features; + +namespace Helpdesk.ServiceDefaults; + +/// Applies the same decoded JSON body budget at the Web gateway and MCP host. +public static class McpRequestBody +{ + public const long DefaultMaximumBytes = 30_000_000; + private const int MemoryThreshold = 1_048_576; + private const int ReadBufferBytes = 8192; + private const long AdditionalFramingBytes = 65_536; + + public static bool IsJsonPost(HttpRequest request) => + string.Equals(request.Path.Value?.TrimEnd('/'), "/mcp", StringComparison.OrdinalIgnoreCase) && + HttpMethods.IsPost(request.Method) && + request.ContentType?.StartsWith("application/json", StringComparison.OrdinalIgnoreCase) == true; + + public static async Task BufferAsync(HttpContext context) + { + var request = context.Request; + var feature = context.Features.Get(); + var maximumBytes = feature?.MaxRequestBodySize ?? DefaultMaximumBytes; + + // Kestrel counts HTTP/1 chunk prefixes, suffixes and extensions against + // its body limit. Keep a separate finite wire budget while enforcing the + // original configured limit on decoded bytes. Thirteen wire bytes cover + // even one-byte chunks with eight hexadecimal size digits; the additional + // allowance covers the final chunk and bounded extension overhead. + var maximumWireBytes = maximumBytes <= (long.MaxValue - AdditionalFramingBytes) / 13 + ? maximumBytes * 13 + AdditionalFramingBytes + : long.MaxValue; + if (feature is { IsReadOnly: false }) feature.MaxRequestBodySize = maximumWireBytes; + + if (request.ContentLength > maximumBytes) + return await RejectAsync(context, maximumBytes, maximumWireBytes, "body"); + + var bufferingLimit = maximumBytes < long.MaxValue ? maximumBytes + 1 : maximumBytes; + request.EnableBuffering(bufferThreshold: MemoryThreshold, bufferLimit: bufferingLimit); + var buffer = ArrayPool.Shared.Rent(ReadBufferBytes); + long inspectedBytes = 0; + try + { + while (true) + { + var remaining = maximumBytes - inspectedBytes; + var readLength = remaining < ReadBufferBytes ? (int)remaining + 1 : ReadBufferBytes; + var count = await request.Body.ReadAsync(buffer.AsMemory(0, readLength), context.RequestAborted); + if (count == 0) break; + inspectedBytes += count; + if (inspectedBytes > maximumBytes) + return await RejectAsync(context, maximumBytes, maximumWireBytes, "body"); + } + } + catch (BadHttpRequestException error) when (error.StatusCode == StatusCodes.Status413PayloadTooLarge) + { + return await RejectAsync(context, maximumBytes, maximumWireBytes, "transport"); + } + finally + { + ArrayPool.Shared.Return(buffer, clearArray: true); + } + + request.Body.Position = 0; + return true; + } + + private static async Task RejectAsync(HttpContext context, long maximumBytes, long maximumWireBytes, string limit) + { + var body = JsonSerializer.SerializeToUtf8Bytes(new + { + type = "about:blank", + title = "MCP request is too large", + status = StatusCodes.Status413PayloadTooLarge, + code = "request_too_large", + limit, + maximumBodyBytes = maximumBytes, + maximumWireBytes + }); + context.Response.StatusCode = StatusCodes.Status413PayloadTooLarge; + context.Response.ContentType = "application/problem+json"; + context.Response.ContentLength = body.Length; + await context.Response.Body.WriteAsync(body, context.RequestAborted); + + // Commit the deliberate response before Kestrel drains an unread declared + // body. The finite wire allowance also prevents an ordinary just-over-limit + // upload from tripping the old limit during that drain and resetting TCP. + await context.Response.CompleteAsync(); + return false; + } +} diff --git a/tests/Helpdesk.Tests/Api/InboundEmailRuleEndpointsTests.cs b/tests/Helpdesk.Tests/Api/InboundEmailRuleEndpointsTests.cs index 1c5104f3..71678bdd 100644 --- a/tests/Helpdesk.Tests/Api/InboundEmailRuleEndpointsTests.cs +++ b/tests/Helpdesk.Tests/Api/InboundEmailRuleEndpointsTests.cs @@ -70,6 +70,14 @@ [new InboundEmailRuleActionConfig(InboundEmailRuleActionType.CreateIncidentForOr disableResponse.EnsureSuccessStatusCode(); var disabled = await disableResponse.Content.ReadFromJsonAsync(); Assert.False(disabled!.Enabled); + + var deleteResponse = await harness.Client.DeleteAsync($"/api/v1/inbound-email-rules/{rulePathId}"); + Assert.Equal(HttpStatusCode.NoContent, deleteResponse.StatusCode); + Assert.DoesNotContain(created.Id, await harness.RuleIdsAsync()); + Assert.Equal(HttpStatusCode.NotFound, (await harness.Client.GetAsync($"/api/v1/inbound-email-rules/{rulePathId}")).StatusCode); + Assert.Equal(HttpStatusCode.NotFound, (await harness.Client.DeleteAsync($"/api/v1/inbound-email-rules/{rulePathId}")).StatusCode); + var retainedAudit = await harness.Client.GetFromJsonAsync>("/api/v1/inbound-email-rules/audit?messageId=message-1"); + Assert.Equal(created.Id, Assert.Single(retainedAudit!).RuleId); } [Fact] diff --git a/tests/Helpdesk.Tests/Api/McpGatewayOwnerInboundRuleTests.cs b/tests/Helpdesk.Tests/Api/McpGatewayOwnerInboundRuleTests.cs new file mode 100644 index 00000000..89c693b8 --- /dev/null +++ b/tests/Helpdesk.Tests/Api/McpGatewayOwnerInboundRuleTests.cs @@ -0,0 +1,91 @@ +using System.Net; +using System.Net.Http.Json; +using Helpdesk.API.Services.IntegrationCredentials; +using Helpdesk.Infrastructure.Persistence; +using Helpdesk.Shared.Auth; +using Helpdesk.Shared.DTOs.EmailRules; +using Helpdesk.Shared.Enums; +using Helpdesk.Shared.Models; +using Microsoft.Extensions.DependencyInjection; + +namespace Helpdesk.Tests.Api; + +public sealed partial class McpGatewayRealAccessPipelineTests +{ + [Theory] + [InlineData(false)] + [InlineData(true)] + public async Task Owner_can_delete_selected_inbound_rule_preserving_audit_while_ordinary_grants_stay_denied(bool postgreSql) + { + await using var harness = postgreSql + ? await GatewayAccessHarness.CreatePostgreSqlAsync(unscopedData: true) + : await GatewayAccessHarness.CreateAsync(unscopedData: true); + await harness.SetOwnerAdministratorAsync(); + var owner = await harness.IssueCredentialAsync(OwnerGrantRequest()); + var ownerExecution = await harness.DelegateAsync(owner); + var ordinary = await harness.IssueCredentialAsync(OwnerGrantRequest() with + { + GrantKind = IntegrationCredentialGrantKinds.Ordinary, + OwnerAdministrationConsent = false, + Permissions = [HelpdeskPermissions.IncidentRead] + }); + var ordinaryExecution = await harness.DelegateAsync(ordinary); + + // The rule belongs to the organization outside the ordinary credential's ceiling. + var create = new CreateInboundEmailRuleRequest(InboundEmailRuleScopeType.Tenant, "org-b", null, + "Owned inbound rule", null, false, 9000, + [new(InboundEmailRuleConditionType.IsForwardedEmail)], + [new(InboundEmailRuleActionType.CreateIncidentForOriginalForwardedSender)], true); + using var createdResponse = await harness.SendAsync(ownerExecution, HttpMethod.Post, + "/api/v1/inbound-email-rules", create); + Assert.Equal(HttpStatusCode.Created, createdResponse.StatusCode); + var created = await createdResponse.Content.ReadFromJsonAsync(); + Assert.NotNull(created); + var path = $"/api/v1/inbound-email-rules/{Uri.EscapeDataString(created.Id)}"; + await harness.SeedInboundRuleAuditAsync(created.Id); + + using var denied = await harness.SendAsync(ordinaryExecution, HttpMethod.Delete, path); + Assert.Equal(HttpStatusCode.Forbidden, denied.StatusCode); + using var unchanged = await harness.GetAsync(ownerExecution, path); + Assert.Equal(HttpStatusCode.OK, unchanged.StatusCode); + + using var deleted = await harness.SendAsync(ownerExecution, HttpMethod.Delete, path); + Assert.Equal(HttpStatusCode.NoContent, deleted.StatusCode); + using var missing = await harness.GetAsync(ownerExecution, path); + Assert.Equal(HttpStatusCode.NotFound, missing.StatusCode); + var list = await harness.GetAsync>(ownerExecution, + "/api/v1/inbound-email-rules?tenantId=org-b"); + Assert.Equal(HttpStatusCode.OK, list.StatusCode); + Assert.DoesNotContain(list.Body!, rule => rule.Id == created.Id); + var audit = await harness.GetAsync>(ownerExecution, + "/api/v1/inbound-email-rules/audit?tenantId=org-b&messageId=owned-rule-message"); + Assert.Equal(HttpStatusCode.OK, audit.StatusCode); + var retained = Assert.Single(audit.Body!); + Assert.Equal(created.Id, retained.RuleId); + Assert.Equal(InboundEmailProcessingStatus.Succeeded, retained.Status); + Assert.Equal("owned-original-ticket", retained.TicketId); + + using var repeated = await harness.SendAsync(ownerExecution, HttpMethod.Delete, path); + Assert.Equal(HttpStatusCode.NotFound, repeated.StatusCode); + var auditAfterReplay = await harness.GetAsync>(ownerExecution, + "/api/v1/inbound-email-rules/audit?tenantId=org-b&messageId=owned-rule-message"); + Assert.Equal(retained, Assert.Single(auditAfterReplay.Body!)); + } + + internal sealed partial class GatewayAccessHarness + { + public async Task SeedInboundRuleAuditAsync(string ruleId) + { + await using var scope = application.Services.CreateAsyncScope(); + var db = scope.ServiceProvider.GetRequiredService(); + db.InboundEmailProcessingLogs.Add(new InboundEmailProcessingLog + { + MessageId = "owned-rule-message", TenantId = "org-b", RuleId = ruleId, + MailboxKey = "default", ActionKey = "CreateIncidentForOriginalForwardedSender", + Matched = true, Status = InboundEmailProcessingStatus.Succeeded, + TicketId = "owned-original-ticket" + }); + await db.SaveChangesAsync(); + } + } +} diff --git a/tests/Helpdesk.Tests/Api/McpGatewayRealAccessPipelineTests.cs b/tests/Helpdesk.Tests/Api/McpGatewayRealAccessPipelineTests.cs index d4239083..44c590bc 100644 --- a/tests/Helpdesk.Tests/Api/McpGatewayRealAccessPipelineTests.cs +++ b/tests/Helpdesk.Tests/Api/McpGatewayRealAccessPipelineTests.cs @@ -10,6 +10,7 @@ using Helpdesk.Mcp.Tools; using Helpdesk.API.Authentication; using Helpdesk.API.Endpoints.Authentication; +using Helpdesk.API.Endpoints.Email; using Helpdesk.API.Endpoints.Incidents; using Helpdesk.API.Endpoints.Integrations; using Helpdesk.API.Endpoints.Requests; @@ -370,7 +371,7 @@ public async Task Simultaneous_gateway_credentials_do_not_share_owner_scope_or_c await harness.AssertDelegationStatusAsync(apiPurposeCredential, GatewayAccessHarness.ResourceUri, HttpStatusCode.Unauthorized); } - internal sealed class GatewayAccessHarness(WebApplication application, IAsyncDisposable database, ConcurrentQueue incidentListQueries) : IAsyncDisposable + internal sealed partial class GatewayAccessHarness(WebApplication application, IAsyncDisposable database, ConcurrentQueue incidentListQueries) : IAsyncDisposable { public const string ResourceUri = "https://helpdesk.example/mcp"; public const string LiteralIncidentSearch = @"Café & A+B 50%_\?"; @@ -505,6 +506,7 @@ private static async Task CreateAsync(Action await AdministrationOwnerResolver.ResolveAsync(user, owners, identity, ct)) diff --git a/tests/Helpdesk.Tests/Api/OpenApiAndVersionEndpointsTests.cs b/tests/Helpdesk.Tests/Api/OpenApiAndVersionEndpointsTests.cs index e35dba8f..64746fd4 100644 --- a/tests/Helpdesk.Tests/Api/OpenApiAndVersionEndpointsTests.cs +++ b/tests/Helpdesk.Tests/Api/OpenApiAndVersionEndpointsTests.cs @@ -129,13 +129,14 @@ public async Task OpenApi_V1_Json_classifies_every_documented_operation() // plus single-change ticket state and external orchestration connectivity testing. // Beta.8 adds exactly six methods: authenticated task approval read/approve/reject, // authenticated Change approval read/review, and authenticated dataset row upsert. + // Beta.11 adds the administrator-authorized inbound email rule deletion operation. // Debug also exposes the authorized /__debug/me endpoint. Keep both inventories // explicit so additions or omissions require a reviewed taxonomy update. #if DEBUG Assert.True(document.RootElement.GetProperty("paths").TryGetProperty("/__debug/me", out _)); - Assert.Equal(423, operationCount); + Assert.Equal(424, operationCount); #else - Assert.Equal(422, operationCount); + Assert.Equal(423, operationCount); #endif var paths = document.RootElement.GetProperty("paths"); foreach (var (path, operationId, tag) in new[] @@ -150,6 +151,17 @@ public async Task OpenApi_V1_Json_classifies_every_documented_operation() Assert.Equal([tag], operation.GetProperty("tags").EnumerateArray().Select(value => value.GetString()).OfType().ToArray()); Assert.Equal(["IntegrationCredential", "JwtBearer", "LocalSession", "McpExecution"], SecuritySchemes(document, path, "post")); } + const string inboundRulePath = "/api/v1/inbound-email-rules/{id}"; + Assert.True(paths.TryGetProperty(inboundRulePath, out var inboundRuleRoute)); + Assert.True(inboundRuleRoute.TryGetProperty("delete", out var inboundRuleDeletion)); + Assert.Equal(["Inbound Email Rules"], inboundRuleDeletion.GetProperty("tags").EnumerateArray().Select(value => value.GetString()).OfType().ToArray()); + Assert.Equal(["IntegrationCredential", "JwtBearer", "LocalSession", "McpExecution"], SecuritySchemes(document, inboundRulePath, "delete")); + var inboundRuleEndpoint = Assert.Single(_factory.Services.GetServices() + .SelectMany(source => source.Endpoints).OfType(), + endpoint => endpoint.RoutePattern.RawText?.TrimEnd('/') == inboundRulePath && + endpoint.Metadata.GetMetadata()?.HttpMethods.Contains("DELETE") == true); + Assert.Null(inboundRuleEndpoint.Metadata.GetMetadata()); + Assert.Contains(inboundRuleEndpoint.Metadata.OfType(), metadata => metadata.Policy == "HelpdeskAdmin"); var identityGroup = Assert.Single(document.RootElement.GetProperty("x-tagGroups").EnumerateArray(), group => group.GetProperty("name").GetString() == "Identity & Access"); Assert.Contains(identityGroup.GetProperty("tags").EnumerateArray(), diff --git a/tests/Helpdesk.Tests/Mcp/McpHttpBodyBoundaryTests.cs b/tests/Helpdesk.Tests/Mcp/McpHttpBodyBoundaryTests.cs new file mode 100644 index 00000000..829ab429 --- /dev/null +++ b/tests/Helpdesk.Tests/Mcp/McpHttpBodyBoundaryTests.cs @@ -0,0 +1,328 @@ +extern alias NewWeb; + +using System.Net; +using System.Net.Http.Headers; +using System.Net.Http.Json; +using System.Net.Sockets; +using System.Text; +using System.Text.Json; +using Helpdesk.ServiceDefaults; +using Microsoft.AspNetCore.Builder; +using Microsoft.AspNetCore.Hosting; +using Microsoft.AspNetCore.Hosting.Server; +using Microsoft.AspNetCore.Hosting.Server.Features; +using Microsoft.AspNetCore.Mvc.Testing; +using Microsoft.Extensions.Configuration; +using Microsoft.Extensions.DependencyInjection; +using Microsoft.Extensions.Logging; +using NewWeb::HelpDesk.NewWeb.Services; +using Xunit; + +namespace Helpdesk.Tests.Mcp; + +public sealed partial class McpHttpHostTests +{ + [Theory] + [InlineData(false)] + [InlineData(true)] + public async Task Kestrel_MCP_body_boundary_is_equivalent_for_declared_and_chunked_requests(bool throughGateway) + { + await using var host = await McpSocketHost.CreateAsync(throughGateway); + var message = JsonSerializer.Serialize(new { jsonrpc = "2.0", id = 71, method = "initialize", @params = InitializeParameters() }); + foreach (var path in new[] { "/mcp", "/mcp/" }) + foreach (var knownLength in new[] { false, true }) + foreach (var length in new[] { 29_990_208, 29_999_999, 30_000_000, 30_000_001 }) + { + using var request = SocketRequest(path, new PaddedJsonContent(message, length, knownLength)); + using var response = await host.Client.SendAsync(request); + if (length > McpRequestBody.DefaultMaximumBytes) + { + await AssertBodyLimitAsync(response, McpRequestBody.DefaultMaximumBytes); + } + else + { + Assert.Equal(HttpStatusCode.OK, response.StatusCode); + using var result = ParseMcpResponse(await response.Content.ReadAsStringAsync()); + Assert.Equal(71, result.RootElement.GetProperty("id").GetInt32()); + Assert.True(result.RootElement.GetProperty("result").TryGetProperty("serverInfo", out _)); + } + } + Assert.Equal(0, host.Outbound.ApiRequests); + Assert.Equal(0, host.Outbound.TokenRequests); + } + + [Theory] + [InlineData(false)] + [InlineData(true)] + public async Task Kestrel_MCP_preserves_smaller_limit_even_with_one_byte_chunks_and_expect_continue(bool throughGateway) + { + const int maximumBytes = 4096; + await using var host = await McpSocketHost.CreateAsync(throughGateway, maximumBytes); + var message = JsonSerializer.Serialize(new { jsonrpc = "2.0", id = 72, method = "initialize", @params = InitializeParameters() }); + foreach (var path in new[] { "/mcp", "/mcp/" }) + { + using (var request = SocketRequest(path, new PaddedJsonContent(message, maximumBytes, knownLength: false, chunkBytes: 1))) + using (var response = await host.Client.SendAsync(request)) + Assert.Equal(HttpStatusCode.OK, response.StatusCode); + + using (var request = SocketRequest(path, new PaddedJsonContent(message, maximumBytes + 1, knownLength: false, chunkBytes: 1))) + using (var response = await host.Client.SendAsync(request)) + await AssertBodyLimitAsync(response, maximumBytes); + + var content = new PaddedJsonContent(message, maximumBytes + 1, knownLength: true); + using var declared = SocketRequest(path, content); + declared.Headers.ExpectContinue = true; + using var rejection = await host.Client.SendAsync(declared); + await AssertBodyLimitAsync(rejection, maximumBytes); + Assert.Equal(0, content.BytesWritten); + } + Assert.Equal(0, host.Outbound.ApiRequests); + } + + [Theory] + [InlineData(false)] + [InlineData(true)] + public async Task Kestrel_MCP_retains_large_duplicate_validation_and_malformed_JSON_behavior(bool throughGateway) + { + await using var host = await McpSocketHost.CreateAsync(throughGateway); + const string duplicate = "{\"jsonrpc\":\"2.0\",\"id\":73,\"method\":\"tools/call\",\"params\":{\"name\":\"helpdesk_notifications\",\"arguments\":{\"operation\":\"summary\"},\"arguments\":{\"operation\":\"mark_read\",\"confirm\":true}}}"; + foreach (var path in new[] { "/mcp", "/mcp/" }) + foreach (var knownLength in new[] { false, true }) + { + using var request = SocketRequest(path, new PaddedJsonContent(duplicate, 1_100_000, knownLength)); + using var response = await host.Client.SendAsync(request); + Assert.Equal(HttpStatusCode.OK, response.StatusCode); + using var result = ParseMcpResponse(await response.Content.ReadAsStringAsync()); + Assert.Equal(73, result.RootElement.GetProperty("id").GetInt32()); + var rpcResult = result.RootElement.GetProperty("result"); + Assert.True(rpcResult.GetProperty("isError").GetBoolean()); + Assert.Equal("validation_failed", rpcResult.GetProperty("structuredContent").GetProperty("status").GetString()); + + using var malformed = SocketRequest(path, new PaddedJsonContent("{\"jsonrpc\":", 1_100_000, knownLength)); + using var malformedResponse = await host.Client.SendAsync(malformed); + Assert.Equal(HttpStatusCode.BadRequest, malformedResponse.StatusCode); + } + Assert.Equal(0, host.Outbound.ApiRequests); + Assert.Equal(0, host.Outbound.TokenRequests); + } + + [Theory] + [InlineData(false)] + [InlineData(true)] + public async Task Kestrel_MCP_still_bounds_excessive_chunk_extensions(bool throughGateway) + { + await using var host = await McpSocketHost.CreateAsync(throughGateway, maximumBytes: 1024); + using var socket = new TcpClient(); + await socket.ConnectAsync(host.Client.BaseAddress!.Host, host.Client.BaseAddress.Port); + await using var stream = socket.GetStream(); + // A tiny decoded body must not permit an unbounded chunk-extension stream. + var request = "POST /mcp HTTP/1.1\r\nHost: localhost\r\nAuthorization: Bearer rdk_local-a\r\n" + + "Content-Type: application/json\r\nAccept: application/json, text/event-stream\r\n" + + "Transfer-Encoding: chunked\r\nConnection: close\r\n\r\n1;pad=" + new string('a', 80_000) + "\r\nx\r\n0\r\n\r\n"; + using var deadline = new CancellationTokenSource(TimeSpan.FromSeconds(30)); + await stream.WriteAsync(Encoding.ASCII.GetBytes(request), deadline.Token); + using var reader = new StreamReader(stream); + var response = await reader.ReadToEndAsync(deadline.Token); + Assert.StartsWith("HTTP/1.1 413", response, StringComparison.Ordinal); + var separator = response.IndexOf("\r\n\r\n", StringComparison.Ordinal); + Assert.True(separator > 0); + using var problem = JsonDocument.Parse(response[(separator + 4)..]); + Assert.Equal("request_too_large", problem.RootElement.GetProperty("code").GetString()); + Assert.Equal("transport", problem.RootElement.GetProperty("limit").GetString()); + Assert.Equal(1024, problem.RootElement.GetProperty("maximumBodyBytes").GetInt32()); + Assert.Equal(0, host.Outbound.ApiRequests); + } + + [Fact] + public async Task Kestrel_MCP_Web_bounds_concurrent_uploads_and_releases_completed_slots() + { + await using var host = await McpSocketHost.CreateAsync(throughGateway: true); + using var deadline = new CancellationTokenSource(TimeSpan.FromSeconds(30)); + var waiting = new List<(TcpClient Socket, NetworkStream Stream, StreamReader Reader)>(); + try + { + for (var index = 0; index < 32; index++) + { + var socket = new TcpClient(); + await socket.ConnectAsync(host.Client.BaseAddress!.Host, host.Client.BaseAddress.Port, deadline.Token); + var stream = socket.GetStream(); + var reader = new StreamReader(stream); + waiting.Add((socket, stream, reader)); + var headers = "POST /mcp HTTP/1.1\r\nHost: localhost\r\nAuthorization: Bearer rdk_local-a\r\n" + + "Content-Type: application/json\r\nAccept: application/json, text/event-stream\r\n" + + "Transfer-Encoding: chunked\r\nExpect: 100-continue\r\nConnection: close\r\n\r\n"; + await stream.WriteAsync(Encoding.ASCII.GetBytes(headers), deadline.Token); + // A 100 response proves this request acquired a lease and began + // reading its body. No timing delay is needed to fill the slots. + Assert.Equal("HTTP/1.1 100 Continue", await reader.ReadLineAsync(deadline.Token)); + Assert.Equal("", await reader.ReadLineAsync(deadline.Token)); + } + + var message = JsonSerializer.Serialize(new { jsonrpc = "2.0", id = 74, method = "initialize", @params = InitializeParameters() }); + using (var overflow = SocketRequest("/mcp", new PaddedJsonContent(message, 512, knownLength: true))) + using (var response = await host.Client.SendAsync(overflow, deadline.Token)) + Assert.Equal(HttpStatusCode.TooManyRequests, response.StatusCode); + + var chunk = Encoding.ASCII.GetBytes($"{Encoding.UTF8.GetByteCount(message):X}\r\n{message}\r\n0\r\n\r\n"); + await waiting[0].Stream.WriteAsync(chunk, deadline.Token); + var completed = await waiting[0].Reader.ReadToEndAsync(deadline.Token); + Assert.StartsWith("HTTP/1.1 200", completed, StringComparison.Ordinal); + Assert.Contains("serverInfo", completed, StringComparison.Ordinal); + + using var resumed = SocketRequest("/mcp", new PaddedJsonContent(message, 512, knownLength: true)); + using var accepted = await host.Client.SendAsync(resumed, deadline.Token); + Assert.Equal(HttpStatusCode.OK, accepted.StatusCode); + } + finally + { + foreach (var (socket, stream, reader) in waiting) + { + reader.Dispose(); + stream.Dispose(); + socket.Dispose(); + } + } + } + + private static HttpRequestMessage SocketRequest(string path, HttpContent content) + { + var request = new HttpRequestMessage(HttpMethod.Post, path) + { + Version = HttpVersion.Version11, + VersionPolicy = HttpVersionPolicy.RequestVersionExact, + Content = content + }; + request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "rdk_local-a"); + request.Headers.Accept.ParseAdd("application/json, text/event-stream"); + return request; + } + + private static async Task AssertBodyLimitAsync(HttpResponseMessage response, long expectedMaximum) + { + Assert.Equal(HttpStatusCode.RequestEntityTooLarge, response.StatusCode); + Assert.Equal("application/problem+json", response.Content.Headers.ContentType?.MediaType); + using var problem = await response.Content.ReadFromJsonAsync(); + Assert.NotNull(problem); + Assert.Equal(413, problem.RootElement.GetProperty("status").GetInt32()); + Assert.Equal("request_too_large", problem.RootElement.GetProperty("code").GetString()); + Assert.Equal("body", problem.RootElement.GetProperty("limit").GetString()); + Assert.Equal(expectedMaximum, problem.RootElement.GetProperty("maximumBodyBytes").GetInt64()); + } + + private sealed class PaddedJsonContent : HttpContent + { + private readonly byte[] _message; + private readonly int _length; + private readonly bool _knownLength; + private readonly int _chunkBytes; + public long BytesWritten { get; private set; } + + public PaddedJsonContent(string message, int length, bool knownLength, int chunkBytes = 8192) + { + _message = Encoding.UTF8.GetBytes(message); + _length = length; + _knownLength = knownLength; + _chunkBytes = chunkBytes; + Headers.ContentType = new MediaTypeHeaderValue("application/json"); + } + + protected override Task SerializeToStreamAsync(Stream stream, TransportContext? context) => + WriteAsync(stream, CancellationToken.None); + + protected override Task SerializeToStreamAsync(Stream stream, TransportContext? context, CancellationToken cancellationToken) => + WriteAsync(stream, cancellationToken); + + private async Task WriteAsync(Stream stream, CancellationToken cancellationToken) + { + var padding = new byte[_chunkBytes]; + Array.Fill(padding, (byte)' '); + for (var remaining = _length - _message.Length; remaining > 0;) + { + var count = Math.Min(remaining, padding.Length); + await stream.WriteAsync(padding.AsMemory(0, count), cancellationToken); + BytesWritten += count; + remaining -= count; + } + await stream.WriteAsync(_message, cancellationToken); + BytesWritten += _message.Length; + } + + protected override bool TryComputeLength(out long value) + { + value = _length; + return _knownLength; + } + } + + private sealed class McpSocketHost : IAsyncDisposable + { + private readonly McpHostEnvironment _environment = new(gateway: true); + private WebApplicationFactory? _factory; + private WebApplication? _gateway; + private WebGatewayConfiguration? _gatewayConfiguration; + public AgentClientBoundaryProbe Outbound { get; } = new(); + public HttpClient Client { get; private set; } = null!; + + public static async Task CreateAsync(bool throughGateway, long maximumBytes = McpRequestBody.DefaultMaximumBytes) + { + var host = new McpSocketHost(); + try + { + host._factory = CreateFactory(host._environment.SigningKey, boundaryProbe: host.Outbound, delegationProbe: new GatewayDelegationProbe()); + host._factory.UseKestrel(options => + { + options.Listen(IPAddress.Loopback, 0); + options.Limits.MaxRequestBodySize = maximumBytes; + }); + host._factory.StartServer(); + var address = host._factory.Services.GetRequiredService().Features.Get()!.Addresses.Single(); + if (throughGateway) + { + host._gatewayConfiguration = new WebGatewayConfiguration(new ConfigurationBuilder().AddInMemoryCollection(new Dictionary + { + ["ApiBaseUrl"] = "http://127.0.0.1:9/", + ["WebGateway:PublicOrigin"] = "https://desk.example/", + ["WebGateway:Mcp:Enabled"] = "true", + ["WebGateway:Mcp:Destination"] = address, + ["WebGateway:Mcp:AuthenticationMode"] = "gateway" + }).Build()); + var builder = WebApplication.CreateBuilder(); + builder.Logging.ClearProviders(); + builder.WebHost.ConfigureKestrel(options => + { + options.Listen(IPAddress.Loopback, 0); + options.Limits.MaxRequestBodySize = maximumBytes; + }); + builder.Services.AddAuthorization(); + builder.Services.AddReverseProxy().LoadFromConfig(host._gatewayConfiguration.EffectiveConfiguration.GetSection("ReverseProxy")); + host._gateway = builder.Build(); + host._gateway.UseRouting(); + host._gateway.UseWebGatewayRequestGuard(host._gatewayConfiguration.Options); + host._gateway.MapReverseProxy().AllowAnonymous(); + await host._gateway.StartAsync(); + address = host._gateway.Urls.Single(); + } + host.Client = new HttpClient(new SocketsHttpHandler { UseProxy = false, Expect100ContinueTimeout = TimeSpan.FromSeconds(30) }) + { + BaseAddress = new Uri(address), + Timeout = TimeSpan.FromSeconds(60) + }; + return host; + } + catch + { + await host.DisposeAsync(); + throw; + } + } + + public async ValueTask DisposeAsync() + { + Client?.Dispose(); + if (_gateway is not null) await _gateway.DisposeAsync(); + _gatewayConfiguration?.Dispose(); + if (_factory is not null) await _factory.DisposeAsync(); + _environment.Dispose(); + } + } +} diff --git a/tests/Helpdesk.Tests/Mcp/OperatorMailSupportTests.cs b/tests/Helpdesk.Tests/Mcp/OperatorMailSupportTests.cs index 4efccff3..aebf6d21 100644 --- a/tests/Helpdesk.Tests/Mcp/OperatorMailSupportTests.cs +++ b/tests/Helpdesk.Tests/Mcp/OperatorMailSupportTests.cs @@ -9,6 +9,40 @@ namespace Helpdesk.Tests.Mcp; public sealed class OperatorMailSupportTests { + [Fact] + public async Task Inbound_rule_delete_preview_has_no_effect_and_confirmation_targets_only_the_selected_rule() + { + var (client, tools) = Create(); + using var request = JsonDocument.Parse("""{"ruleId":"rule/a?b"}"""); + + var preview = await tools.helpdesk_email_settings("delete_rule", request.RootElement); + + Assert.Equal("confirmation_required", preview.Status); + await client.DidNotReceive().SendAsync(Arg.Any(), Arg.Any(), Arg.Any(), Arg.Any(), Arg.Any()); + + var confirmed = await tools.helpdesk_email_settings("delete_rule", request.RootElement, confirm: true); + + Assert.True(confirmed.Success, confirmed.Summary); + await client.Received(1).SendAsync(HttpMethod.Delete, "/api/v1/inbound-email-rules/rule%2Fa%3Fb", + null, true, Arg.Any()); + } + + [Theory] + [InlineData("{}")] + [InlineData("""{"ruleId":""}""")] + [InlineData("""{"ruleId":"owned-rule","tenantId":"foreign-tenant"}""")] + [InlineData("""{"ruleId":"owned-rule","ruleId":"other-rule"}""")] + public async Task Inbound_rule_delete_rejects_missing_ambiguous_or_unadvertised_selectors(string json) + { + var (client, tools) = Create(); + using var request = JsonDocument.Parse(json); + + var result = await tools.helpdesk_email_settings("delete_rule", request.RootElement, confirm: true); + + Assert.Equal("validation_failed", result.Status); + await client.DidNotReceive().SendAsync(Arg.Any(), Arg.Any(), Arg.Any(), Arg.Any(), Arg.Any()); + } + [Theory] [InlineData("""{"pageSize":1}""")] [InlineData("""{"pageSize":101}""")] diff --git a/tests/http_mcp/campaign_reads.py b/tests/http_mcp/campaign_reads.py index 811e088f..f95c837c 100644 --- a/tests/http_mcp/campaign_reads.py +++ b/tests/http_mcp/campaign_reads.py @@ -6,6 +6,7 @@ """ import argparse +import copy import hashlib import json from pathlib import Path @@ -45,7 +46,7 @@ def pointer(value, path): return value -def read_operation(catalog, case): +def read_operation(catalog, case, validate_arguments=True): rows = {x["tool"] + "." + x["operation"]: x for x in catalog["operations"]} op = rows[case["operation"]] if op["method"] != "GET" or op["readOnly"] is not True: @@ -56,7 +57,7 @@ def read_operation(catalog, case): args = {"operation": op["operation"]} if "request" in case: args["request"] = case["request"] - if not Draft202012Validator(schema, format_checker=FormatChecker()).is_valid(args): + if validate_arguments and not Draft202012Validator(schema, format_checker=FormatChecker()).is_valid(args): raise CampaignError("Plan arguments do not satisfy the selected catalog schema") if not case.get("assertions"): raise CampaignError("Every read needs fixture-specific typed assertions") @@ -82,12 +83,26 @@ def read_operation(catalog, case): return op, args, path + (("?" + urlencode(query, doseq=True)) if query else "") -def compare(mcp, api, assertions): +def compare(mcp, api, assertions, sla_countdown_tolerance=0): if mcp.get("success") is not True or "data" not in mcp: raise CampaignError("MCP read did not succeed with structured data") if mcp["data"] in (None, [], {}): raise CampaignError("Empty observations do not establish positive fixture coverage") - if mcp["data"] != api: + if type(sla_countdown_tolerance) is not int or not 0 <= sla_countdown_tolerance <= 5: + raise CampaignError("SLA countdown tolerance must be an integer from zero to five seconds") + left, right = copy.deepcopy(mcp["data"]), copy.deepcopy(api) + if sla_countdown_tolerance: + # Only these documented live countdowns may differ between sequential + # reads. Every other field, including SLA state and deadlines, stays exact. + for name in ("responseRemainingSeconds", "resolutionRemainingSeconds"): + path = "/sla/" + name + if any(check["pointer"] in ("", "/sla", path) for check in assertions): + raise CampaignError("Use stable fixture assertions alongside an SLA countdown tolerance") + before, after = pointer(left, path), pointer(right, path) + if type(before) is not int or type(after) is not int or abs(before - after) > sla_countdown_tolerance: + raise CampaignError("SLA countdown exceeded the explicitly bounded tolerance") + left["sla"][name] = right["sla"][name] + if left != right: raise CampaignError("MCP data differs from the independent API observation") for check in assertions: observed = pointer(api, check["pointer"]) @@ -95,6 +110,37 @@ def compare(mcp, api, assertions): raise CampaignError("Typed fixture assertion failed") +def resolve_bindings(value, bindings): + """Resolve exact references only from same-run independently verified reads.""" + if isinstance(value, dict): + return {name: resolve_bindings(item, bindings) for name, item in value.items()} + if isinstance(value, list): + return [resolve_bindings(item, bindings) for item in value] + if isinstance(value, str) and "${" in value: + match = re.fullmatch(r"\$\{([A-Za-z][A-Za-z0-9_-]*\.[A-Za-z][A-Za-z0-9_-]*)\}", value) + if not match or match[1] not in bindings: + raise CampaignError("Fixture reference was not discovered and independently verified in this run") + return bindings[match[1]] + return value + + +def discovered_values(fixture, api): + if not re.fullmatch(r"[A-Za-z][A-Za-z0-9_-]*", fixture.get("id", "")): + raise CampaignError("Fixture needs a unique simple name") + selectors = fixture.get("selectors") + if not isinstance(selectors, dict) or not 1 <= len(selectors) <= 20: + raise CampaignError("Fixture needs bounded explicit selector pointers") + result = {} + for name, path in selectors.items(): + if not re.fullmatch(r"[A-Za-z][A-Za-z0-9_-]*", name): + raise CampaignError("Fixture selector needs a simple name") + value = pointer(api, path) + if type(value) not in (str, int) or value == "": + raise CampaignError("Discovered fixture selector must be a nonempty string or integer") + result[fixture["id"] + "." + name] = value + return result + + def decode_api_read(path, raw, headers): # The workflow metrics API deliberately serves Prometheus; match the MCP # adapter's explicit representation without accepting arbitrary non-JSON. @@ -223,20 +269,11 @@ def independent_api(self, path): return body, self.captures.write("api-independent", {"observedAt": at, "path": path, "body": body}) -def run(args): +def load_profile(profile_path): repo = Path(__file__).resolve().parents[2] - output = args.output.resolve() - profile_path = args.profile.resolve() - if output.is_relative_to(repo) or profile_path.is_relative_to(repo): + profile_path = profile_path.resolve() + if profile_path.is_relative_to(repo): raise CampaignError("Profile and evidence must remain outside the source checkout") - catalog_bytes = args.catalog.read_bytes() - catalog = json.loads(catalog_bytes) - plan = json.loads(args.plan.read_text(encoding="utf-8")) - # Validate the whole plan before issuing even an initialize call. - prepared = [read_operation(catalog, case) for case in plan["cases"]] - ids = [case["id"] for case in plan["cases"]] - if not ids or len(ids) != len(set(ids)): - raise CampaignError("Use at least one case with unique case IDs") profile = json.loads(profile_path.read_text(encoding="utf-8-sig")) keypath = Path(profile["credentialFile"]) keypath = keypath if keypath.is_absolute() else profile_path.parent / keypath @@ -249,6 +286,32 @@ def run(args): credential = credential_bytes.decode("utf-8-sig").strip() if not credential or "\n" in credential or "\r" in credential: raise CampaignError("Credential file must contain one nonempty credential") + return profile, credential + + +def run(args): + repo = Path(__file__).resolve().parents[2] + output = args.output.resolve() + profile_path = args.profile.resolve() + if output.is_relative_to(repo) or profile_path.is_relative_to(repo): + raise CampaignError("Profile and evidence must remain outside the source checkout") + catalog_bytes = args.catalog.read_bytes() + catalog = json.loads(catalog_bytes) + plan = json.loads(args.plan.read_text(encoding="utf-8")) + # Validate the whole plan before issuing even an initialize call. + fixtures = plan.get("fixtures", []) + if not isinstance(fixtures, list) or len(fixtures) > 100: + raise CampaignError("Fixture discovery must be a bounded list") + prepared_fixtures = [read_operation(catalog, fixture) for fixture in fixtures] + # Check operation safety before any network request. Arguments that reference + # fixtures are schema-validated after their same-run discovery, before use. + for case in plan["cases"]: + read_operation(catalog, case, validate_arguments=not fixtures) + ids = [case["id"] for case in plan["cases"]] + fixture_ids = [fixture["id"] for fixture in fixtures] + if not ids or len(ids) != len(set(ids)) or len(fixture_ids) != len(set(fixture_ids)): + raise CampaignError("Use at least one case with unique case IDs") + profile, credential = load_profile(profile_path) # Refuse existing output rather than silently mixing candidate runs. output.mkdir(mode=0o700, parents=False, exist_ok=False) captures = Captures(output, [credential]) @@ -256,7 +319,7 @@ def run(args): summary = {"startedAt": utc(), "catalogSha256": hashlib.sha256(catalog_bytes).hexdigest(), "planSha256": hashlib.sha256(args.plan.read_bytes()).hexdigest(), "scope": "Selected read-only supporting evidence; not full campaign acceptance", - "cases": [], "completed": False} + "fixtures": [], "cases": [], "completed": False} try: initialized, _ = transport.rpc("initialize", {"protocolVersion": "2025-03-26", "capabilities": {}, "clientInfo": {"name": "rateldesk-campaign-reads", "version": "1"}}) @@ -268,14 +331,28 @@ def run(args): actual = {x["name"]: x["inputSchema"] for x in live.get("result", {}).get("tools", [])} if live.get("result", {}).get("nextCursor") or actual != expected: raise CampaignError("Live tools/schema differ from the supplied released catalog") - for case, (op, arguments, path) in zip(plan["cases"], prepared): + bindings = {} + for fixture, (op, arguments, path) in zip(fixtures, prepared_fixtures): + wire, mcp_ref = transport.rpc("tools/call", {"name": op["tool"], "arguments": arguments}) + api, api_ref = transport.independent_api(path) + compare(wire.get("result", {}).get("structuredContent", {}), api, fixture["assertions"], + fixture.get("slaCountdownToleranceSeconds", 0)) + selected = discovered_values(fixture, api) + bindings.update(selected) + summary["fixtures"].append({"id": fixture["id"], "operation": fixture["operation"], + "selectors": selected, "mcp": mcp_ref, "independentApi": api_ref, + "assertions": fixture["assertions"]}) + for unresolved in plan["cases"]: + case = resolve_bindings(unresolved, bindings) + op, arguments, path = read_operation(catalog, case) wire, mcp_ref = transport.rpc("tools/call", {"name": op["tool"], "arguments": arguments}) result = wire.get("result", {}).get("structuredContent", {}) api, api_ref = transport.independent_api(path) - compare(result, api, case["assertions"]) + compare(result, api, case["assertions"], case.get("slaCountdownToleranceSeconds", 0)) summary["cases"].append({"id": case["id"], "operation": case["operation"], "outcome": "PASS", "mcp": mcp_ref, "independentApi": api_ref, - "assertions": case["assertions"]}) + "assertions": case["assertions"], + "slaCountdownToleranceSeconds": case.get("slaCountdownToleranceSeconds", 0)}) summary["completed"] = True finally: summary["completedAt"] = utc() diff --git a/tests/http_mcp/campaign_transport.py b/tests/http_mcp/campaign_transport.py new file mode 100644 index 00000000..03d7f463 --- /dev/null +++ b/tests/http_mcp/campaign_transport.py @@ -0,0 +1,158 @@ +#!/usr/bin/env python3 +"""Opt-in read-only initialize probes at the deployed HTTP decoded-body boundary. + +Uses the explicitly selected HTTPS MCP profile. Each route/framing/boundary gets +one request, with no retry or target fallback. Bodies contain valid initialize +JSON plus whitespace; no tools/call or business mutation is issued. +""" + +import argparse +import hashlib +import http.client +import json +from pathlib import Path +import sys +import time +from urllib.parse import urlsplit +import uuid + +from campaign_reads import CampaignError, Captures, Transport, load_profile, utc + + +DEFAULT_LIMIT = 30_000_000 + + +def initialize_body(size, rpc_id): + message = {"jsonrpc": "2.0", "id": rpc_id, "method": "initialize", "params": { + "protocolVersion": "2025-03-26", "capabilities": {}, + "clientInfo": {"name": "rateldesk-beta11-body-boundary", "version": "1"}}} + raw = json.dumps(message, separators=(",", ":")).encode() + if size < len(raw): + raise CampaignError("Configured body limit is too small for a valid initialize control") + return raw + b" " * (size - len(raw)) + + +def decode_response(raw, rpc_id): + if raw.lstrip().startswith(b"{"): + return json.loads(raw) + for line in raw.decode().splitlines(): + if line.startswith("data:"): + value = json.loads(line[5:].strip()) + if value.get("id") == rpc_id: + return value + return {"nonJsonResponse": True} + + +def probe(resource, credential, path, framing, body, rpc_id): + uri = urlsplit(resource) + connection = http.client.HTTPSConnection(uri.hostname, uri.port or 443, timeout=60) + headers = {"Authorization": "Bearer " + credential, "Content-Type": "application/json", + "Accept": "application/json, text/event-stream", "MCP-Protocol-Version": "2025-03-26"} + tick, at = time.monotonic(), utc() + try: + if framing == "chunked": + headers["Transfer-Encoding"] = "chunked" + chunks = (body[index:index + 16384] for index in range(0, len(body), 16384)) + connection.request("POST", path, body=chunks, headers=headers, encode_chunked=True) + else: + headers["Content-Length"] = str(len(body)) + connection.request("POST", path, body=body, headers=headers) + response = connection.getresponse() + raw = response.read(8 * 1024 * 1024 + 1) + if len(raw) > 8 * 1024 * 1024: + raise CampaignError("Transport probe response exceeds the capture bound") + return {"observedAt": at, "httpStatus": response.status, + "contentType": response.getheader("Content-Type"), "body": decode_response(raw, rpc_id), + "latencyMs": (time.monotonic() - tick) * 1000} + finally: + connection.close() + + +def expected_result(response, size, limit, rpc_id): + body = response.get("body", {}) + if size <= limit: + return response.get("httpStatus") == 200 and body.get("id") == rpc_id and bool(body.get("result", {}).get("serverInfo")) + return (response.get("httpStatus") == 413 and body.get("status") == 413 + and body.get("code") == "request_too_large" and body.get("limit") == "body" + and body.get("maximumBodyBytes") == limit) + + +def run(args): + if type(args.limit) is not int or not 1 < args.limit <= DEFAULT_LIMIT: + raise CampaignError("Use the observed decoded-body limit, no greater than 30000000 bytes") + if args.output.resolve().is_relative_to(Path(__file__).resolve().parents[2]): + raise CampaignError("Transport evidence must remain outside the checkout") + profile, credential = load_profile(args.profile) + Transport(profile["resourceUri"], credential, None) # Exact resource and TLS validation. + manifest = json.loads(args.manifest.read_text(encoding="utf-8-sig")) + if manifest.get("version") != "0.1.2-beta.11" or not manifest.get("sourceRevision"): + raise CampaignError("Transport probes require the pinned beta.11 release manifest") + evidence_root = (args.evidence_root or args.output).resolve() + if not args.output.resolve().is_relative_to(evidence_root): + raise CampaignError("Transport output must be inside the selected evidence root") + prefix = args.output.resolve().relative_to(evidence_root) + args.output.mkdir(mode=0o700, parents=False, exist_ok=False) + captures = Captures(args.output, [credential]) + transport = Transport(profile["resourceUri"], credential, captures) + def save(kind, value): + reference = captures.write(kind, value) + reference["path"] = (prefix / reference["path"]).as_posix() + return reference + def observe_identity(): + raw, _, at, _ = transport.request(transport.origin + "/api/v1/system/version", "GET", None, + {"Accept": "application/json"}) + identity = json.loads(raw) + reference = save("deployment-identity", {"observedAt": at, "body": identity}) + if identity.get("version") != manifest["version"] or identity.get("commitHash") != manifest["sourceRevision"]: + raise CampaignError("Public API identity differs from the pinned beta.11 manifest") + return reference + summary = {"format": "rateldesk-beta11-body-boundary/v1", "startedAt": utc(), + "maximumBodyBytes": args.limit, "completed": False, "cases": [], + "resourceUri": profile["resourceUri"], "version": manifest["version"], + "sourceRevision": manifest["sourceRevision"], + "scope": "Fresh transport supporting evidence; not full campaign acceptance"} + cases = [(path, framing, size) for path in ("/mcp", "/mcp/") + for framing in ("content-length", "chunked") for size in (args.limit - 1, args.limit, args.limit + 1)] + if args.limit == DEFAULT_LIMIT: + cases.append(("/mcp/", "chunked", 29_990_208)) + try: + summary["identityBefore"] = observe_identity() + for path, framing, size in cases: + rpc_id = str(uuid.uuid4()) + body = initialize_body(size, rpc_id) + request = {"observedAt": utc(), "path": path, "framing": framing, + "decodedBodyBytes": len(body), "bodySha256": hashlib.sha256(body).hexdigest(), + "rpcId": rpc_id, "method": "initialize", "generator": "valid-json-plus-trailing-whitespace/v1"} + request_ref = save("transport-request", request) + try: + response = probe(profile["resourceUri"], credential, path, framing, body, rpc_id) + passed = expected_result(response, size, args.limit, rpc_id) + except (OSError, http.client.HTTPException, ValueError, CampaignError) as error: + response = {"observedAt": utc(), "transportErrorType": type(error).__name__} + passed = False + response_ref = save("transport-response", response) + summary["cases"].append({"path": path, "framing": framing, "decodedBodyBytes": size, + "request": request_ref, "response": response_ref, "passed": passed}) + print(f"{path} {framing} {size} bytes: {'PASS' if passed else 'FAIL'}", flush=True) + summary["identityAfter"] = observe_identity() + summary["completed"] = True + finally: + summary["completedAt"] = utc() + reference = save("transport-summary", summary) + print(json.dumps({"transportBoundary": reference}), flush=True) + return 0 if all(case["passed"] for case in summary["cases"]) else 1 + + +if __name__ == "__main__": + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--profile", required=True, type=Path) + parser.add_argument("--output", required=True, type=Path) + parser.add_argument("--manifest", required=True, type=Path) + parser.add_argument("--evidence-root", type=Path) + parser.add_argument("--limit", type=int, default=DEFAULT_LIMIT) + try: + raise SystemExit(run(parser.parse_args())) + except Exception as error: + print(str(error) if isinstance(error, CampaignError) else + "Transport probes stopped (" + type(error).__name__ + "); inspect private captures.", file=sys.stderr) + raise SystemExit(1) diff --git a/tests/http_mcp/read-plan-discovery.example.json b/tests/http_mcp/read-plan-discovery.example.json new file mode 100644 index 00000000..6938acfe --- /dev/null +++ b/tests/http_mcp/read-plan-discovery.example.json @@ -0,0 +1,26 @@ +{ + "fixtures": [ + { + "id": "ownedIncident", + "operation": "helpdesk_incidents.list", + "request": {"q": "REPLACE_WITH_CURRENT_CAMPAIGN_UNIQUE_SUBJECT", "page": 1, "pageSize": 10, "includeTotal": true}, + "assertions": [ + {"pointer": "/total", "expected": 1}, + {"pointer": "/items/0/subject", "expected": "REPLACE_WITH_CURRENT_CAMPAIGN_UNIQUE_SUBJECT"} + ], + "selectors": {"id": "/items/0/id", "trackingId": "/items/0/trackingId"} + } + ], + "cases": [ + { + "id": "fresh-owned-incident-read", + "operation": "helpdesk_incidents.get", + "request": {"incidentId": "${ownedIncident.id}"}, + "assertions": [ + {"pointer": "/id", "expected": "${ownedIncident.id}"}, + {"pointer": "/trackingId", "expected": "${ownedIncident.trackingId}"}, + {"pointer": "/subject", "expected": "REPLACE_WITH_CURRENT_CAMPAIGN_UNIQUE_SUBJECT"} + ] + } + ] +} diff --git a/tests/http_mcp/test_beta11_campaign.py b/tests/http_mcp/test_beta11_campaign.py new file mode 100644 index 00000000..da43b1dd --- /dev/null +++ b/tests/http_mcp/test_beta11_campaign.py @@ -0,0 +1,271 @@ +"""Synthetic rejection tests for the current gate; never live acceptance evidence.""" + +import copy +import hashlib +from datetime import datetime, timezone +import importlib.util +import json +from pathlib import Path +import tempfile +from types import SimpleNamespace +import unittest + + +ROOT = Path(__file__).resolve().parents[2] +SPEC = importlib.util.spec_from_file_location("beta11_gate_tests", ROOT / "tools/ci/validate-beta11-campaign.py") +gate = importlib.util.module_from_spec(SPEC) +SPEC.loader.exec_module(gate) + + +class Beta11CampaignTests(unittest.TestCase): + def setUp(self): + self.temporary = tempfile.TemporaryDirectory() + self.addCleanup(self.temporary.cleanup) + self.root = Path(self.temporary.name) + self.sequence = 0 + + def write(self, data): + self.sequence += 1 + path = self.root / f"capture-{self.sequence}.json" + path.write_text(json.dumps(data) + "\n") + return {"path": path.name, "sha256": gate.legacy.sha256(path)} + + def catalog(self, omit=None): + ids = set(gate.read_json(gate.BASELINE)["operationIds"]) | {"helpdesk_email_settings.delete_rule"} + ids.discard(omit) + operations, tools = [], {} + for identity in sorted(ids): + tool, operation = identity.split(".", 1) + operations.append({"tool": tool, "operation": operation, "confirmationRequired": False, "readOnly": True}) + tools.setdefault(tool, []).append(operation) + schemas = [{"tool": tool, "inputSchema": {"properties": {"operation": {"enum": names}}}} + for tool, names in tools.items()] + data = {"catalogRevision": gate.CATALOG_REVISION, "operationCount": len(ids), + "operations": operations, "toolSchemas": schemas, + "catalogHash": gate.legacy.native_hash(operations), "schemaHash": gate.legacy.native_hash(schemas)} + return self.root / self.write(data)["path"] + + def test_current_workspace_has_all_denominators_and_no_inherited_passes(self): + catalog = self.catalog() + directory = self.root / "fresh" + result = gate.initialize(directory, catalog) + self.assertEqual((result["operations"], result["domainCases"], result["historicalObligations"]), (390, 103, 86)) + receipt = gate.read_json(directory / "receipt.json") + self.assertEqual(receipt["readiness"], "NOT_RUN") + self.assertTrue(all(row["state"] == "NOT_RUN" for row in receipt["operations"])) + progress = gate.progress(receipt, catalog) + self.assertEqual(len(progress["operationsNeedingEvidence"]), 390) + self.assertEqual(progress["readiness"], "NOT_VALIDATED") + with self.assertRaises(gate.Invalid): + gate.initialize(directory, catalog) + + def test_old_operation_cannot_be_silently_removed(self): + with self.assertRaises(gate.Invalid): + gate.export_catalog(self.catalog(omit="helpdesk_incidents.get")) + + def test_recorded_pass_without_capture_mapping_remains_incomplete(self): + catalog = self.catalog() + receipt = gate.legacy.template(catalog) + for row in receipt["operations"]: + row["state"] = "PASS" + progress = gate.progress(receipt, catalog) + self.assertEqual(len(progress["operationsNeedingEvidence"]), 390) + + def snapshots(self): + scope = {"campaignId": "synthetic-campaign", "correlation": "synthetic-owned-approval"} + before = {"observedAt": "2026-10-25T00:00:01Z", "scope": scope, "effects": []} + first = {"observedAt": "2026-10-25T00:00:02Z", "scope": scope, + "effects": [{"id": "synthetic-effect", "effectKey": "synthetic-key"}]} + replay = dict(copy.deepcopy(first), observedAt="2026-10-25T00:00:03Z") + return before, first, replay + + def test_approval_effect_sets_are_compared_not_only_counts(self): + before, first, replay = self.snapshots() + self.assertEqual(gate.effect_cardinality(before, first, 1, replay)["replayAddedEffects"], 0) + replay["effects"][0]["id"] = "replacement-effect" + with self.assertRaises(gate.Invalid): + gate.effect_cardinality(before, first, 1, replay) + + def test_effect_scope_duplication_and_unobserved_first_effect_fail(self): + for change in ("scope", "duplicate", "missing"): + before, first, replay = self.snapshots() + if change == "scope": + replay["scope"]["correlation"] = "another-fixture" + elif change == "duplicate": + replay["effects"].append({"id": "second", "effectKey": "synthetic-key"}) + else: + first["effects"] = [] + with self.assertRaises(gate.Invalid): + gate.effect_cardinality(before, first, 1, replay) + + def boundary(self): + validator = object.__new__(gate.Validator) + validator.root, validator.files, validator.bytes = self.root, {}, 0 + validator.context = {"sourceRevision": "a" * 40} + validator.started = datetime(2026, 10, 25, tzinfo=timezone.utc) + validator.completed = datetime(2026, 10, 25, 1, tzinfo=timezone.utc) + validator.functional = validator.completed + limit = 30_000_000 + summary = {"format": "rateldesk-beta11-body-boundary/v1", "completed": True, + "version": gate.VERSION, "sourceRevision": "a" * 40, "maximumBodyBytes": limit, + "startedAt": "2026-10-25T00:00:00Z", "completedAt": "2026-10-25T00:00:06Z", "cases": []} + for key, at in (("identityBefore", "2026-10-25T00:00:01Z"), ("identityAfter", "2026-10-25T00:00:05Z")): + summary[key] = self.write({"observedAt": at, "body": {"version": gate.VERSION, "commitHash": "a" * 40}}) + rows = [(path, framing, size) for path in ("/mcp", "/mcp/") for framing in ("content-length", "chunked") + for size in (limit - 1, limit, limit + 1)] + [("/mcp/", "chunked", 29_990_208)] + for number, (path, framing, size) in enumerate(rows): + rpc_id = "synthetic-" + str(number) + request = {"path": path, "framing": framing, "decodedBodyBytes": size, "rpcId": rpc_id, + "method": "initialize", "observedAt": "2026-10-25T00:00:02Z", + "bodySha256": hashlib.sha256(rpc_id.encode()).hexdigest()} + response = {"observedAt": "2026-10-25T00:00:03Z", "httpStatus": 200 if size <= limit else 413, + "body": {"id": rpc_id, "result": {"serverInfo": {"name": "synthetic"}}} if size <= limit else { + "status": 413, "code": "request_too_large", "limit": "body", "maximumBodyBytes": limit}} + summary["cases"].append({"path": path, "framing": framing, "decodedBodyBytes": size, + "request": self.write(request), "response": self.write(response)}) + validator.data = {"transportBoundary": self.write(summary)} + return validator, summary + + def test_full_boundary_matrix_passes_but_one_missing_route_case_fails(self): + validator, summary = self.boundary() + validator.transport_boundary() + summary["cases"].pop(0) + validator.data["transportBoundary"] = self.write(summary) + with self.assertRaises(gate.Invalid): + validator.transport_boundary() + + def test_connection_reset_cannot_be_relabelled_as_successful_oversize_rejection(self): + validator, summary = self.boundary() + oversized = next(row for row in summary["cases"] if row["decodedBodyBytes"] > 30_000_000) + oversized["response"] = self.write({"observedAt": "2026-10-25T00:00:03Z", "transportErrorType": "ConnectionResetError"}) + validator.data["transportBoundary"] = self.write(summary) + with self.assertRaises(gate.Invalid): + validator.transport_boundary() + + def isolation(self): + validator = object.__new__(gate.Validator) + validator.root, validator.files, validator.bytes, validator.case_cache = self.root, {}, 0, {} + validator.context = {"campaignId": "synthetic-campaign"} + validator.started = datetime(2026, 10, 25, tzinfo=timezone.utc) + validator.completed = datetime(2026, 10, 25, 1, tzinfo=timezone.utc) + validator.functional = validator.completed + validator.actors = {"owner": {"kind": "owner"}, "ordinary": {"kind": "scoped"}} + notification = {"id": "00000000-0000-0000-0000-000000000001", "readAt": None} + before = self.write({"observedAt": "2026-10-25T00:00:01Z", "body": notification}) + after = self.write({"observedAt": "2026-10-25T00:00:03Z", "body": notification}) + request = self.write({"jsonrpc": "2.0", "id": "synthetic-rpc", "method": "tools/call", "params": { + "name": "helpdesk_notifications", "arguments": {"operation": "mark_read", "confirm": True, + "request": {"ids": [notification["id"]]}}}}) + response = self.write({"jsonrpc": "2.0", "id": "synthetic-rpc", "result": {"structuredContent": { + "success": True, "status": "completed", "data": {"updated": 0}}}}) + row = {"id": "isolation", "operation": "helpdesk_notifications.mark_read", "actor": "ordinary", + "kind": "expected_negative", "outcome": "PASS", "origin": "fresh_deployed", "transport": "http", + "context": validator.context, "startedAt": "2026-10-25T00:00:00Z", "completedAt": "2026-10-25T00:00:05Z", + "effectObserved": False, "request": request, "response": response, + "isolationReadback": {"ownerActor": "owner", "before": before, "after": after}, + "postcondition": {"observedAt": "2026-10-25T00:00:04Z", "independent": True, "assertions": [ + {"id": "other_actor_read_marker_unchanged", "surface": "api", "evidence": after, + "pointer": "/body/readAt", "expected": None}, + {"id": "stored_marker_unchanged", "surface": "storage", "evidence": after, + "pointer": "/body/readAt", "expected": None}]}} + validator.data = {"cases": {"isolation": self.write(row)}} + return validator, row + + def test_zero_update_isolation_keeps_wire_response_and_cannot_be_positive(self): + validator, row = self.isolation() + result = validator.case("isolation", "expected_negative") + self.assertEqual(result["wireStatus"], "completed") + original = validator.evidence(row["response"]) + self.assertIs(original["result"]["structuredContent"]["success"], True) + with self.assertRaises(gate.Invalid): + validator.case("isolation", "positive") + + def test_zero_update_without_exact_independent_readbacks_fails(self): + for change in ("same_capture", "wrong_owner", "missing_storage", "wrong_record"): + validator, row = self.isolation() + if change == "same_capture": + row["isolationReadback"]["after"] = row["isolationReadback"]["before"] + elif change == "wrong_owner": + row["isolationReadback"]["ownerActor"] = "ordinary" + elif change == "missing_storage": + row["postcondition"]["assertions"].pop() + else: + after = validator.evidence(row["isolationReadback"]["after"]) + after["body"]["readAt"] = "2026-10-25T00:00:02Z" + row["isolationReadback"]["after"] = self.write(after) + validator.data["cases"]["isolation"] = self.write(row) + with self.assertRaises(gate.Invalid): + validator.case("isolation", "expected_negative") + + def test_prerequisite_template_is_incomplete_and_false_facts_cannot_be_ready(self): + data = gate.prerequisite_template() + data["authenticationMode"] = "Local" + result = gate.check_prerequisites(data, self.root) + self.assertFalse(result["ready"]) + self.assertEqual(len(result["missing"]), len(gate.PREREQUISITES)) + row = data["items"][0] + row["state"], row["observedAt"] = "READY", "2026-10-24T00:00:00Z" + for assertion in row["assertions"]: + assertion.update(evidence=self.write({"ready": False}), pointer="/ready", expected=False) + with self.assertRaises(gate.Invalid): + gate.check_prerequisites(data, self.root) + + def test_complete_current_synthetic_receipt_and_missing_new_effect_proof(self): + # Reuse the immutable gate's explicitly synthetic fixture builder to + # exercise its entire inherited gate with current release bindings. + spec = importlib.util.spec_from_file_location("beta11_synthetic_fixture_builder", ROOT / "tools/ci/test-beta8-campaign.py") + builder = importlib.util.module_from_spec(spec) + spec.loader.exec_module(builder) + builder.gate = SimpleNamespace(**{name: value for name, value in vars(gate.legacy).items() if not name.startswith("__")}) + builder.gate.Validator = gate.Validator + fixture = builder.CampaignGateTests() + fixture.root, fixture.sequence, fixture.source = self.root, 0, "a" * 40 + fixture.now = datetime(2026, 10, 25, 1, tzinfo=timezone.utc) + fixture.catalog_path = self.catalog() + fixture.catalog = gate.read_json(fixture.catalog_path) + fixture.catalog_ref = {"path": fixture.catalog_path.name, "sha256": gate.legacy.sha256(fixture.catalog_path)} + fixture.ops = {row["tool"] + "." + row["operation"]: row for row in fixture.catalog["operations"]} + fixture.prepare_receipt() + + _, boundary = self.boundary() + def redate(value): + if isinstance(value, dict): + if set(value) == {"path", "sha256"}: + return fixture.write(redate(gate.read_json(self.root / value["path"]))) + return {name: redate(item) for name, item in value.items()} + if isinstance(value, list): + return [redate(item) for item in value] + if isinstance(value, str): + return value.replace("2026-10-25T00:00:", "2026-10-19T00:11:") + return value + fixture.receipt["transportBoundary"] = fixture.write(redate(boundary)) + + def add_effects(case_id, include_replay): + row = fixture.read(fixture.receipt["cases"][case_id]) + snapshots = self.snapshots() + for snapshot, minute in zip(snapshots, (12, 13, 14)): + snapshot["observedAt"] = f"2026-10-19T00:{minute}:00Z" + snapshot["scope"]["campaignId"] = fixture.context["campaignId"] + row["effectCardinality"] = {"expectedNewEffects": 1, + "before": fixture.write(snapshots[0]), "first": fixture.write(snapshots[1])} + if include_replay: + row["effectCardinality"]["replay"] = fixture.write(snapshots[2]) + else: + row["postcondition"] = fixture.observation(["direct_send_delivery_matches_effect"], ("storage", "transport_capture")) + fixture.receipt["cases"][case_id] = fixture.write(row) + mail_case = fixture.operation("helpdesk_mail.send")["positiveCaseId"] + add_effects(mail_case, False) + support = next(row for row in fixture.receipt["scenarios"] if row["id"] == "support") + add_effects(support["cases"]["concurrent_approval_decisions"], True) + result = fixture.validator().validate() + self.assertEqual(result["version"], "0.1.2-beta.11") + self.assertEqual(result["operationsPassed"], 383) + self.assertEqual((result["scenarioCases"], result["historicalObligations"]), (103, 86)) + self.assertTrue(result["httpBodyBoundaryValidated"]) + fixture.change_case(mail_case, lambda row: row.pop("effectCardinality")) + with self.assertRaises(gate.Invalid): + fixture.validator().validate() + + +if __name__ == "__main__": + unittest.main() diff --git a/tests/http_mcp/test_campaign_reads.py b/tests/http_mcp/test_campaign_reads.py index 95a6ba06..c21072ed 100644 --- a/tests/http_mcp/test_campaign_reads.py +++ b/tests/http_mcp/test_campaign_reads.py @@ -9,7 +9,8 @@ from types import SimpleNamespace from urllib.error import HTTPError -from campaign_reads import CampaignError, Captures, NoRedirect, Transport, compare, decode_api_read, read_operation, run +from campaign_reads import (CampaignError, Captures, NoRedirect, Transport, compare, + decode_api_read, discovered_values, read_operation, resolve_bindings, run) CATALOG = json.loads((Path(__file__).resolve().parents[2] / @@ -17,6 +18,46 @@ class ReadCampaignTests(unittest.TestCase): + def test_same_run_discovery_resolves_exact_selector_references(self): + fixture = {"id": "incident", "selectors": {"id": "/items/0/id"}} + values = discovered_values(fixture, {"items": [{"id": "current-owned-id"}]}) + resolved = resolve_bindings({"request": {"incidentId": "${incident.id}"}}, values) + self.assertEqual(resolved["request"]["incidentId"], "current-owned-id") + + def test_unknown_or_interpolated_selector_cannot_fall_back_to_stale_id(self): + for value in ("${deleted.id}", "prefix-${incident.id}", "${incident.id}/other"): + with self.assertRaises(CampaignError): + resolve_bindings(value, {"incident.id": "owned"}) + + def test_fixture_discovery_rejects_empty_and_nonscalar_selectors(self): + for value in ("", [], {}, None, True): + with self.assertRaises(CampaignError): + discovered_values({"id": "incident", "selectors": {"id": "/id"}}, {"id": value}) + + def test_sla_tolerance_preserves_raw_captures_and_compares_stable_fields(self): + mcp = {"success": True, "data": {"id": "owned", "state": 1, + "sla": {"responseRemainingSeconds": 100, "resolutionRemainingSeconds": 200}}} + api = {"id": "owned", "state": 1, + "sla": {"responseRemainingSeconds": 99, "resolutionRemainingSeconds": 199}} + checks = [{"pointer": "/id", "expected": "owned"}] + with self.assertRaises(CampaignError): + compare(mcp, api, checks) + compare(mcp, api, checks, 2) + self.assertEqual(mcp["data"]["sla"]["responseRemainingSeconds"], 100) + api["state"] = 2 + with self.assertRaises(CampaignError): + compare(mcp, api, checks, 2) + + def test_sla_tolerance_cannot_hide_large_drift_or_change_asserted_values(self): + mcp = {"success": True, "data": {"id": "owned", + "sla": {"responseRemainingSeconds": 100, "resolutionRemainingSeconds": 200}}} + api = {"id": "owned", "sla": {"responseRemainingSeconds": 90, "resolutionRemainingSeconds": 190}} + for tolerance in (2, 6, True): + with self.assertRaises(CampaignError): + compare(mcp, api, [{"pointer": "/id", "expected": "owned"}], tolerance) + with self.assertRaises(CampaignError): + compare(mcp, mcp["data"], [{"pointer": "/sla", "expected": mcp["data"]["sla"]}], 2) + def test_metrics_text_matches_explicit_mcp_projection(self): text = b"# TYPE helpdesk_tasks_in_progress gauge\nhelpdesk_tasks_in_progress 2\n" api = decode_api_read("/api/v1/metrics/workflows", text, {"Content-Type": "text/plain; version=0.0.4"}) diff --git a/tests/http_mcp/test_campaign_transport.py b/tests/http_mcp/test_campaign_transport.py new file mode 100644 index 00000000..a275acdb --- /dev/null +++ b/tests/http_mcp/test_campaign_transport.py @@ -0,0 +1,41 @@ +"""Offline checks for exact body generation and transport outcome classification.""" + +import json +import unittest + +from campaign_reads import CampaignError +from campaign_transport import decode_response, expected_result, initialize_body + + +class TransportCampaignTests(unittest.TestCase): + def test_generated_control_is_valid_json_at_exact_requested_size(self): + raw = initialize_body(4096, "synthetic-rpc") + self.assertEqual(len(raw), 4096) + message = json.loads(raw) + self.assertEqual(message["id"], "synthetic-rpc") + self.assertEqual(message["method"], "initialize") + self.assertNotIn("tools/call", raw.decode()) + with self.assertRaises(CampaignError): + initialize_body(1, "synthetic-rpc") + + def test_at_limit_requires_actual_initialize_success_and_original_rpc_id(self): + response = {"httpStatus": 200, "body": {"id": "synthetic-rpc", "result": {"serverInfo": {"name": "fixture"}}}} + self.assertTrue(expected_result(response, 4096, 4096, "synthetic-rpc")) + self.assertFalse(expected_result(response, 4096, 4096, "other-rpc")) + self.assertFalse(expected_result({"httpStatus": 200, "body": {"error": {}}}, 4096, 4096, "synthetic-rpc")) + + def test_oversize_requires_documented_body_413_not_proxy_or_reset(self): + response = {"httpStatus": 413, "body": {"status": 413, "code": "request_too_large", "limit": "body", "maximumBodyBytes": 4096}} + self.assertTrue(expected_result(response, 4097, 4096, "synthetic-rpc")) + self.assertFalse(expected_result({"httpStatus": 413, "body": {}}, 4097, 4096, "synthetic-rpc")) + self.assertFalse(expected_result({"transportErrorType": "ConnectionResetError"}, 4097, 4096, "synthetic-rpc")) + response["body"]["limit"] = "transport" + self.assertFalse(expected_result(response, 4097, 4096, "synthetic-rpc")) + + def test_sse_response_selects_the_matching_rpc(self): + raw = b'data: {"id":"other","result":{}}\n\ndata: {"id":"synthetic-rpc","result":{"serverInfo":{"name":"fixture"}}}\n' + self.assertEqual(decode_response(raw, "synthetic-rpc")["id"], "synthetic-rpc") + + +if __name__ == "__main__": + unittest.main() diff --git a/tools/ci/beta10-operation-ids.json b/tools/ci/beta10-operation-ids.json new file mode 100644 index 00000000..d3149089 --- /dev/null +++ b/tools/ci/beta10-operation-ids.json @@ -0,0 +1,395 @@ +{ + "sourceVersion": "0.1.2-beta.10", + "operationCount": 389, + "operationIds": [ + "helpdesk_admin_mutations.create_category", + "helpdesk_admin_mutations.create_customer", + "helpdesk_admin_mutations.create_organization", + "helpdesk_admin_mutations.create_request_form", + "helpdesk_admin_mutations.create_role", + "helpdesk_admin_mutations.create_self_service_request", + "helpdesk_admin_mutations.create_service", + "helpdesk_admin_mutations.create_service_request_form", + "helpdesk_admin_mutations.create_user", + "helpdesk_admin_mutations.customer_disable_login", + "helpdesk_admin_mutations.customer_invite", + "helpdesk_admin_mutations.customer_resend_invite", + "helpdesk_admin_mutations.customer_sync_authentik", + "helpdesk_admin_mutations.delete_category", + "helpdesk_admin_mutations.delete_customer", + "helpdesk_admin_mutations.delete_organization", + "helpdesk_admin_mutations.delete_request_form", + "helpdesk_admin_mutations.delete_role", + "helpdesk_admin_mutations.delete_service", + "helpdesk_admin_mutations.delete_user", + "helpdesk_admin_mutations.provision_user", + "helpdesk_admin_mutations.update_category", + "helpdesk_admin_mutations.update_customer", + "helpdesk_admin_mutations.update_organization", + "helpdesk_admin_mutations.update_organization_branding", + "helpdesk_admin_mutations.update_request_form", + "helpdesk_admin_mutations.update_role", + "helpdesk_admin_mutations.update_service", + "helpdesk_admin_mutations.update_user", + "helpdesk_ai_assistant.chat", + "helpdesk_ai_assistant.chat_abandon", + "helpdesk_ai_assistant.chat_capabilities", + "helpdesk_ai_assistant.chat_history", + "helpdesk_ai_assistant.chat_new", + "helpdesk_ai_assistant.chat_open", + "helpdesk_ai_assistant.chat_reconcile", + "helpdesk_ai_assistant.chat_respond", + "helpdesk_ai_assistant.chat_send", + "helpdesk_ai_assistant.chat_stop_waiting", + "helpdesk_ai_assistant.create_webhook", + "helpdesk_ai_assistant.dispatch_investigation", + "helpdesk_ai_assistant.eligible_configurations", + "helpdesk_ai_assistant.investigation_worklog", + "helpdesk_ai_assistant.report", + "helpdesk_ai_assistant.set_webhook_state", + "helpdesk_ai_assistant.update_webhook", + "helpdesk_ai_assistant.webhook_configurations", + "helpdesk_attachments.download", + "helpdesk_attachments.list", + "helpdesk_attachments.upload", + "helpdesk_auth.access", + "helpdesk_auth.revoke_self", + "helpdesk_auth.status", + "helpdesk_automation.approve_task", + "helpdesk_automation.approver_candidates", + "helpdesk_automation.binding_by_task", + "helpdesk_automation.binding_drift_preview", + "helpdesk_automation.binding_issues", + "helpdesk_automation.bindings", + "helpdesk_automation.callback_rejections", + "helpdesk_automation.create_binding", + "helpdesk_automation.create_form", + "helpdesk_automation.create_request_definition", + "helpdesk_automation.create_rule", + "helpdesk_automation.critical_failures", + "helpdesk_automation.delete_binding", + "helpdesk_automation.delete_rule", + "helpdesk_automation.escalated_tasks", + "helpdesk_automation.get_binding", + "helpdesk_automation.get_rule", + "helpdesk_automation.import_binding_inputs", + "helpdesk_automation.mark_binding_import_pending", + "helpdesk_automation.my_task_approval", + "helpdesk_automation.overdue_tasks", + "helpdesk_automation.pending_retries", + "helpdesk_automation.refresh_binding_drift", + "helpdesk_automation.reject_task", + "helpdesk_automation.rules", + "helpdesk_automation.sync_binding_inputs", + "helpdesk_automation.update_binding", + "helpdesk_automation.update_form", + "helpdesk_automation.update_rule", + "helpdesk_automation.workflow_metrics", + "helpdesk_automation.workflow_timeline", + "helpdesk_capabilities.get", + "helpdesk_categories.list", + "helpdesk_changes.add_worklog", + "helpdesk_changes.assign", + "helpdesk_changes.assign_self", + "helpdesk_changes.attachments_count", + "helpdesk_changes.bulk_create", + "helpdesk_changes.bulk_state", + "helpdesk_changes.create", + "helpdesk_changes.delete", + "helpdesk_changes.get", + "helpdesk_changes.lifecycle", + "helpdesk_changes.list", + "helpdesk_changes.listeners_count", + "helpdesk_changes.my_approval", + "helpdesk_changes.review_approval", + "helpdesk_changes.state", + "helpdesk_changes.timeline", + "helpdesk_changes.timeline_count", + "helpdesk_changes.update", + "helpdesk_changes.worklogs", + "helpdesk_config.get", + "helpdesk_config.set", + "helpdesk_config.show", + "helpdesk_config.unset", + "helpdesk_connections.confirm_netclaw_session_owner", + "helpdesk_connections.delete_mapping", + "helpdesk_connections.delete_pair", + "helpdesk_connections.directory", + "helpdesk_connections.generate_pairing_code", + "helpdesk_connections.incident_sources", + "helpdesk_connections.list", + "helpdesk_connections.netclaw_settings", + "helpdesk_connections.netclaw_unbound_sessions", + "helpdesk_connections.pair", + "helpdesk_connections.pair_netclaw", + "helpdesk_connections.register_incident_source", + "helpdesk_connections.save_mapping", + "helpdesk_connections.set_incident_source_credential", + "helpdesk_connections.set_incident_source_state", + "helpdesk_connections.test_mapping", + "helpdesk_connections.test_netclaw", + "helpdesk_connections.test_netclaw_draft", + "helpdesk_connections.update_netclaw_settings", + "helpdesk_connectivity.orchestration", + "helpdesk_connectivity.orchestration_bindings", + "helpdesk_connectivity.orchestration_jobs", + "helpdesk_connectivity.orchestration_request_definitions", + "helpdesk_connectivity.orchestration_tenants", + "helpdesk_connectivity.orchestration_test", + "helpdesk_customers.auth_status", + "helpdesk_customers.get", + "helpdesk_customers.list", + "helpdesk_datasets.create", + "helpdesk_datasets.create_credential", + "helpdesk_datasets.credentials", + "helpdesk_datasets.delete", + "helpdesk_datasets.get", + "helpdesk_datasets.graph_settings", + "helpdesk_datasets.list", + "helpdesk_datasets.options", + "helpdesk_datasets.revoke_credential", + "helpdesk_datasets.rows", + "helpdesk_datasets.save_graph_settings", + "helpdesk_datasets.sync_graph", + "helpdesk_datasets.update", + "helpdesk_datasets.upsert_rows", + "helpdesk_email_settings.archive", + "helpdesk_email_settings.create", + "helpdesk_email_settings.create_layout", + "helpdesk_email_settings.create_rule", + "helpdesk_email_settings.create_template", + "helpdesk_email_settings.delete_layout", + "helpdesk_email_settings.delete_template", + "helpdesk_email_settings.diagnostics", + "helpdesk_email_settings.disable", + "helpdesk_email_settings.disable_rule", + "helpdesk_email_settings.effective", + "helpdesk_email_settings.enable", + "helpdesk_email_settings.enable_rule", + "helpdesk_email_settings.get", + "helpdesk_email_settings.get_rule", + "helpdesk_email_settings.historical_import", + "helpdesk_email_settings.historical_preview", + "helpdesk_email_settings.layout_choices", + "helpdesk_email_settings.layouts", + "helpdesk_email_settings.list", + "helpdesk_email_settings.outgoing", + "helpdesk_email_settings.preview_template", + "helpdesk_email_settings.reorder_rules", + "helpdesk_email_settings.retry_receipt", + "helpdesk_email_settings.rule_audit", + "helpdesk_email_settings.rules", + "helpdesk_email_settings.save_outgoing", + "helpdesk_email_settings.send_test", + "helpdesk_email_settings.set_worker", + "helpdesk_email_settings.sync", + "helpdesk_email_settings.templates", + "helpdesk_email_settings.test_draft_mailbox", + "helpdesk_email_settings.test_mailbox", + "helpdesk_email_settings.test_outgoing", + "helpdesk_email_settings.update", + "helpdesk_email_settings.update_layout", + "helpdesk_email_settings.update_rule", + "helpdesk_email_settings.update_template", + "helpdesk_email_settings.upload_template_image", + "helpdesk_email_settings.worker_status", + "helpdesk_enums.change_lifecycle_state", + "helpdesk_enums.list", + "helpdesk_enums.request_task_status", + "helpdesk_enums.ticket_priority", + "helpdesk_enums.ticket_state", + "helpdesk_examples.list", + "helpdesk_health.get", + "helpdesk_incidents.add_worklog", + "helpdesk_incidents.assign", + "helpdesk_incidents.assign_self", + "helpdesk_incidents.attachments_count", + "helpdesk_incidents.bulk_create", + "helpdesk_incidents.bulk_delete", + "helpdesk_incidents.bulk_marketing_spam", + "helpdesk_incidents.bulk_state", + "helpdesk_incidents.close", + "helpdesk_incidents.create", + "helpdesk_incidents.create_relation", + "helpdesk_incidents.delete", + "helpdesk_incidents.delete_relation", + "helpdesk_incidents.get", + "helpdesk_incidents.list", + "helpdesk_incidents.listeners_count", + "helpdesk_incidents.peek", + "helpdesk_incidents.relations", + "helpdesk_incidents.state", + "helpdesk_incidents.timeline", + "helpdesk_incidents.timeline_count", + "helpdesk_incidents.update", + "helpdesk_logs.search", + "helpdesk_mail.changed_route_preview", + "helpdesk_mail.failed", + "helpdesk_mail.outgoing_retry_preview", + "helpdesk_mail.pending", + "helpdesk_mail.pending_actions", + "helpdesk_mail.pending_count", + "helpdesk_mail.pending_organizations", + "helpdesk_mail.retry", + "helpdesk_mail.retry_confirmed_undelivered", + "helpdesk_mail.retry_current_outgoing", + "helpdesk_mail.retry_current_route", + "helpdesk_mail.send", + "helpdesk_mail.test_provider", + "helpdesk_mail.uncertain_retry_preview", + "helpdesk_notifications.error_summary", + "helpdesk_notifications.get", + "helpdesk_notifications.list", + "helpdesk_notifications.mark_read", + "helpdesk_notifications.summary", + "helpdesk_notifications.timeline", + "helpdesk_notifications.unread", + "helpdesk_notifications.unread_errors", + "helpdesk_organizations.change_participants", + "helpdesk_organizations.get", + "helpdesk_organizations.list", + "helpdesk_organizations.tenant_lookup", + "helpdesk_organizations.tenants", + "helpdesk_raw.get_change", + "helpdesk_raw.get_incident", + "helpdesk_raw.get_request", + "helpdesk_raw.system_version", + "helpdesk_request_forms.by_service", + "helpdesk_request_forms.get", + "helpdesk_request_tasks.bulk_complete", + "helpdesk_request_tasks.bulk_retry", + "helpdesk_request_tasks.bulk_start", + "helpdesk_request_tasks.complete", + "helpdesk_request_tasks.create", + "helpdesk_request_tasks.delete", + "helpdesk_request_tasks.fail", + "helpdesk_request_tasks.get", + "helpdesk_request_tasks.list", + "helpdesk_request_tasks.retry", + "helpdesk_request_tasks.start", + "helpdesk_request_tasks.update", + "helpdesk_requests.add_worklog", + "helpdesk_requests.assign", + "helpdesk_requests.assign_self", + "helpdesk_requests.attachments_count", + "helpdesk_requests.bulk_create", + "helpdesk_requests.bulk_state", + "helpdesk_requests.create", + "helpdesk_requests.delete", + "helpdesk_requests.get", + "helpdesk_requests.list", + "helpdesk_requests.listeners_count", + "helpdesk_requests.state", + "helpdesk_requests.tasks", + "helpdesk_requests.timeline", + "helpdesk_requests.timeline_count", + "helpdesk_requests.update", + "helpdesk_roles.get", + "helpdesk_roles.list", + "helpdesk_schema.list", + "helpdesk_search.customers", + "helpdesk_search.organizations", + "helpdesk_search.users", + "helpdesk_self_service.get_request", + "helpdesk_self_service.request_users", + "helpdesk_self_service.requests", + "helpdesk_services.breadcrumb", + "helpdesk_services.get", + "helpdesk_services.items", + "helpdesk_services.list", + "helpdesk_services.search_items", + "helpdesk_sla.breached", + "helpdesk_sla.calendars", + "helpdesk_sla.completed", + "helpdesk_sla.compliance", + "helpdesk_sla.create_calendar", + "helpdesk_sla.create_policy", + "helpdesk_sla.create_report_subscription", + "helpdesk_sla.delete_calendar", + "helpdesk_sla.delete_policy", + "helpdesk_sla.delete_report_subscription", + "helpdesk_sla.near_breach", + "helpdesk_sla.pause_ticket", + "helpdesk_sla.policies", + "helpdesk_sla.report_subscriptions", + "helpdesk_sla.resume_ticket", + "helpdesk_sla.save_tenant_settings", + "helpdesk_sla.tenant_settings", + "helpdesk_sla.update_calendar", + "helpdesk_sla.update_policy", + "helpdesk_sla.update_report_subscription", + "helpdesk_support.add_member", + "helpdesk_support.bootstrap_defaults", + "helpdesk_support.coverage", + "helpdesk_support.create_coverage", + "helpdesk_support.create_group", + "helpdesk_support.create_subscription", + "helpdesk_support.delete_coverage", + "helpdesk_support.delete_group", + "helpdesk_support.delete_subscription", + "helpdesk_support.get_group", + "helpdesk_support.groups", + "helpdesk_support.members", + "helpdesk_support.my_preferences", + "helpdesk_support.recipient_preview", + "helpdesk_support.remove_member", + "helpdesk_support.set_my_preference", + "helpdesk_support.set_user_preference", + "helpdesk_support.subscriptions", + "helpdesk_support.update_coverage", + "helpdesk_support.update_group", + "helpdesk_support.update_member", + "helpdesk_support.update_subscription", + "helpdesk_support.user_preferences", + "helpdesk_system.version", + "helpdesk_tenant_admin.assets", + "helpdesk_tenant_admin.assignments", + "helpdesk_tenant_admin.background_worker_settings", + "helpdesk_tenant_admin.create_asset", + "helpdesk_tenant_admin.create_local_account", + "helpdesk_tenant_admin.customer_dashboard", + "helpdesk_tenant_admin.dashboard", + "helpdesk_tenant_admin.delegable_roles", + "helpdesk_tenant_admin.delete_asset", + "helpdesk_tenant_admin.delete_my_credential_record", + "helpdesk_tenant_admin.disable_local_account", + "helpdesk_tenant_admin.enable_local_account", + "helpdesk_tenant_admin.get_asset", + "helpdesk_tenant_admin.instance_branding", + "helpdesk_tenant_admin.local_account_assignments", + "helpdesk_tenant_admin.local_account_status", + "helpdesk_tenant_admin.members", + "helpdesk_tenant_admin.my_credentials", + "helpdesk_tenant_admin.online_users", + "helpdesk_tenant_admin.organizations", + "helpdesk_tenant_admin.replace_assignments", + "helpdesk_tenant_admin.replace_local_account_assignments", + "helpdesk_tenant_admin.reset_customer_login", + "helpdesk_tenant_admin.reset_local_account", + "helpdesk_tenant_admin.revoke_my_credential", + "helpdesk_tenant_admin.settings", + "helpdesk_tenant_admin.technician_dashboard", + "helpdesk_tenant_admin.tenant_branding", + "helpdesk_tenant_admin.update_asset", + "helpdesk_tenant_admin.update_background_worker_settings", + "helpdesk_tenant_admin.update_instance_branding", + "helpdesk_tenant_admin.update_settings", + "helpdesk_tenant_admin.upload_branding_logo", + "helpdesk_tickets.attachments_count", + "helpdesk_tickets.current_assignee", + "helpdesk_tickets.customer_options", + "helpdesk_tickets.filter_options", + "helpdesk_tickets.incident_activity", + "helpdesk_tickets.listeners_count", + "helpdesk_tickets.mark_as_seen", + "helpdesk_tickets.organization_options", + "helpdesk_tickets.request_worklogs", + "helpdesk_tickets.search_assignees", + "helpdesk_tickets.self_service_tasks", + "helpdesk_tickets.set_customer", + "helpdesk_tickets.timeline_count", + "helpdesk_users.by_email", + "helpdesk_users.get", + "helpdesk_users.list" + ] +} diff --git a/tools/ci/validate-beta11-campaign.py b/tools/ci/validate-beta11-campaign.py new file mode 100644 index 00000000..cefefd5f --- /dev/null +++ b/tools/ci/validate-beta11-campaign.py @@ -0,0 +1,361 @@ +#!/usr/bin/env python3 +"""Beta.11 evidence gate and private campaign workspace. + +The beta.8 validator and contract remain immutable. This release adapter reuses +their strict provenance, operation, domain, history, soak and cleanup checks with +explicit beta.11 identity bindings. Offline validation cannot authenticate a +capture's provenance and never performs a live operation. +""" + +import argparse +from datetime import datetime, timezone +import importlib.util +import json +from pathlib import Path +import sys + + +VERSION = "0.1.2-beta.11" +FORMAT = "rateldesk-beta11-campaign/v1" +CATALOG_REVISION = "2026-10-25.beta11-contracts-v25" +BASELINE = Path(__file__).with_name("beta10-operation-ids.json") +BASELINE_HASH = "4d3c42a3a95c336962f7fbe3630328bd6bcf0345c6004f7041deb9ff626e48a3" + +# A separate module instance leaves consumers of the historical validator and +# every previous receipt unchanged. Only release identity parameters are adapted. +_spec = importlib.util.spec_from_file_location( + "rateldesk_beta11_inherited_gate", Path(__file__).with_name("validate-beta8-campaign.py")) +legacy = importlib.util.module_from_spec(_spec) +_spec.loader.exec_module(legacy) +legacy.VERSION, legacy.FORMAT, legacy.CATALOG_REVISION = VERSION, FORMAT, CATALOG_REVISION +_export_catalog = legacy.export_catalog +Invalid, require, read_json = legacy.Invalid, legacy.require, legacy.read_json + + +def export_catalog(path): + catalog, operations = _export_catalog(path) + require(legacy.sha256(BASELINE) == BASELINE_HASH, "fixed beta.10 operation denominator changed") + baseline = read_json(BASELINE) + require(len(baseline["operationIds"]) == len(set(baseline["operationIds"])) == 389, + "historical operation denominator is incomplete") + expected = set(baseline["operationIds"]) | {"helpdesk_email_settings.delete_rule"} + require(set(operations) == expected and len(operations) == 390, + "beta.11 must preserve all 389 historical operations and add inbound rule deletion") + return catalog, operations + + +legacy.export_catalog = export_catalog + + +def effect_cardinality(before, first, expected_new, replay=None): + """Compare independently enumerated, exactly scoped durable effects.""" + require(type(expected_new) is int and 1 <= expected_new <= 1000, "expected effect count must be positive and bounded") + scope = before.get("scope") + require(isinstance(scope, dict) and scope.get("campaignId") and scope.get("correlation"), + "effect snapshots need exact campaign and correlation scope") + snapshots = [before, first] + ([replay] if replay is not None else []) + observed, sets = [], [] + for snapshot in snapshots: + require(snapshot.get("scope") == scope, "effect snapshot scopes differ") + observed.append(legacy.timestamp(snapshot.get("observedAt"))) + rows = legacy.index(snapshot.get("effects"), "effect") + require(all(isinstance(row.get("effectKey"), str) and row["effectKey"] for row in rows.values()), + "every durable effect needs its independently observed key") + require(len({row["effectKey"] for row in rows.values()}) == len(rows), "duplicate durable effect keys observed") + sets.append({identity: row["effectKey"] for identity, row in rows.items()}) + require(observed == sorted(observed) and len(set(observed)) == len(observed), + "effect snapshots must be separately captured in order") + require(all(sets[1].get(identity) == key for identity, key in sets[0].items()), + "existing effects disappeared or changed identity") + require(len(set(sets[1]) - set(sets[0])) == expected_new, "first execution has unexpected durable effect cardinality") + if replay is not None: + require(sets[2] == sets[1], "replay added, removed or replaced a durable effect") + return {"newEffects": expected_new, "replayAddedEffects": 0 if replay is not None else None} + + +class Validator(legacy.Validator): + def transport_boundary(self): + summary = self.evidence(self.data.get("transportBoundary")) + require(summary.get("format") == "rateldesk-beta11-body-boundary/v1" and summary.get("completed") is True, + "live HTTP body boundary matrix is incomplete") + require(summary.get("version") == VERSION and summary.get("sourceRevision") == self.context["sourceRevision"], + "transport boundary belongs to another release") + start, end = self.fresh(summary.get("startedAt")), self.fresh(summary.get("completedAt")) + require(start <= end <= self.functional, "transport boundary must complete before functional completion") + for name in ("identityBefore", "identityAfter"): + identity = self.evidence(summary.get(name)) + require(start <= self.fresh(identity.get("observedAt")) <= end and + identity.get("body", {}).get("version") == VERSION and + identity.get("body", {}).get("commitHash") == self.context["sourceRevision"], + "transport deployment identity changed or was not observed") + limit = summary.get("maximumBodyBytes") + require(type(limit) is int and 1 < limit <= 30_000_000, "invalid effective decoded-body limit") + if limit != 30_000_000: + configured = self.evidence(self.data.get("transportLimitConfiguration")) + require(configured.get("maximumBodyBytes") == limit and self.fresh(configured.get("observedAt")) <= start, + "a smaller body limit needs independent effective configuration evidence") + expected = {(path, framing, size) for path in ("/mcp", "/mcp/") + for framing in ("content-length", "chunked") for size in (limit - 1, limit, limit + 1)} + if limit == 30_000_000: + expected.add(("/mcp/", "chunked", 29_990_208)) + rows = summary.get("cases", []) + keys = [(row.get("path"), row.get("framing"), row.get("decodedBodyBytes")) for row in rows] + require(len(keys) == len(set(keys)) and set(keys) == expected, + "every route/framing/below/at/above body-boundary case is required exactly once") + rpc_ids = set() + for row in rows: + request, response = self.evidence(row.get("request")), self.evidence(row.get("response")) + require((request.get("path"), request.get("framing"), request.get("decodedBodyBytes")) == + (row["path"], row["framing"], row["decodedBodyBytes"]), "transport request identity mismatch") + require(request.get("method") == "initialize" and request.get("rpcId") and + legacy.HASH.fullmatch(request.get("bodySha256", "")), "transport control metadata is incomplete") + require(request["rpcId"] not in rpc_ids, "transport matrix reused a previous RPC identity") + rpc_ids.add(request["rpcId"]) + require(start <= self.fresh(request.get("observedAt")) <= self.fresh(response.get("observedAt")) <= end, + "transport captures are outside the matrix interval") + body = response.get("body", {}) + if row["decodedBodyBytes"] <= limit: + require(response.get("httpStatus") == 200 and body.get("id") == request["rpcId"] and + body.get("result", {}).get("serverInfo"), "valid boundary initialize did not succeed") + else: + require(response.get("httpStatus") == body.get("status") == 413 and + body.get("code") == "request_too_large" and body.get("limit") == "body" and + body.get("maximumBodyBytes") == limit, "oversized body needs the deliberate documented 413") + + def validate(self): + result = super().validate() + self.transport_boundary() + result["httpBodyBoundaryValidated"] = True + result["validatedEvidenceFiles"] = len(self.files) + return result + + def verify_effects(self, case, replay=False, expected_new=None): + proof = case.get("effectCardinality", {}) + before, first = self.evidence(proof.get("before")), self.evidence(proof.get("first")) + repeated = self.evidence(proof.get("replay")) if replay else None + snapshots = [before, first] + ([repeated] if replay else []) + for snapshot in snapshots: + require(snapshot.get("scope", {}).get("campaignId") == self.context["campaignId"], + "effect cardinality belongs to another campaign") + require(legacy.timestamp(case["startedAt"]) <= self.fresh(snapshot.get("observedAt")) + <= legacy.timestamp(case["completedAt"]), "effect snapshot is outside its functional case") + expected = proof.get("expectedNewEffects") + require(expected_new is None or expected == expected_new, "direct send must create exactly one durable outbox effect") + return effect_cardinality(before, first, expected, repeated) + + def operation_coverage(self): + coverage = super().operation_coverage() + row = next(row for row in self.data["operations"] if row["id"] == "helpdesk_mail.send") + case = self.case(row["positiveCaseId"], "positive", "helpdesk_mail.send") + self.verify_effects(case, expected_new=1) + require("direct_send_delivery_matches_effect" in case["verifiedAssertions"] and + {"storage", "transport_capture"} <= case["verifiedSurfaces"], + "direct mail needs its actual outbox effect and independent provider delivery") + return coverage + + def scenarios_and_history(self): + super().scenarios_and_history() + support = next(row for row in self.data["scenarios"] if row["id"] == "support") + self.verify_effects(self.case(support["cases"]["concurrent_approval_decisions"], "positive"), replay=True) + + def case(self, identity, kind=None, operation=None): + require(isinstance(identity, str) and identity in self.data["cases"], "missing case receipt") + if identity in self.case_cache: + return super().case(identity, kind, operation) + row = self.evidence(self.data["cases"][identity]) + # Personal-notification isolation can legitimately return updated:0. + # Keep the actual wire response and require fresh, exact before/after + # owner readback. This exception never supplies positive mutation or + # administrator-denial coverage. + if row.get("operation") != "helpdesk_notifications.mark_read" or row.get("kind") != "expected_negative": + return super().case(identity, kind, operation) + response = self.evidence(row.get("response")) + result = legacy.tool_response(response) + if result.get("success") is not True: + return super().case(identity, kind, operation) + require(row.get("context") == self.context and row.get("id") == identity, + "isolation case belongs to another campaign/source/catalog") + require(row.get("outcome") == "PASS" and row.get("origin") == "fresh_deployed" + and row.get("transport") == "http", "isolation needs fresh deployed HTTP MCP") + start, end = self.fresh(row.get("startedAt")), self.fresh(row.get("completedAt")) + require(start <= end <= self.functional, "isolation case exceeds functional window") + require(row.get("actor") in self.actors and self.actors[row["actor"]].get("kind") == "scoped", + "zero-effect notification isolation needs the observed ordinary actor") + request = self.evidence(row.get("request")) + params = request.get("params", {}) + arguments = params.get("arguments", {}) + require(request.get("method") == "tools/call" and params.get("name") == "helpdesk_notifications" + and arguments.get("operation") == "mark_read" and arguments.get("confirm") is True, + "isolation must be an actual confirmed mark-read attempt") + require(request.get("id") is not None and request.get("id") == response.get("id"), + "isolation RPC IDs differ") + updated = result.get("data", {}).get("updated") + require(type(updated) is int and updated == 0 and row.get("effectObserved") is False, + "isolation response did not report exactly zero changes") + isolation = row.get("isolationReadback", {}) + require(isolation.get("ownerActor") in self.actors and isolation["ownerActor"] != row["actor"], + "foreign notification needs a distinct observed owner actor") + before_ref, after_ref = isolation.get("before"), isolation.get("after") + before, after = self.evidence(before_ref), self.evidence(after_ref) + require(before_ref["sha256"] != after_ref["sha256"], "isolation reused the same capture") + require(start <= self.fresh(before.get("observedAt")) < self.fresh(after.get("observedAt")) <= end, + "isolation readbacks must be fresh and ordered") + old, new = before.get("body"), after.get("body") + require(isinstance(old, dict) and old.get("id") and old == new, + "foreign notification state changed or lacked an exact record readback") + require(arguments.get("request", {}).get("ids") == [old["id"]], + "isolation readback does not identify the selected notification") + names, surfaces = self.assertions(row["postcondition"], + (row["request"]["sha256"], row["response"]["sha256"])) + require("other_actor_read_marker_unchanged" in names and {"api", "storage"} <= surfaces, + "foreign marker isolation needs its actual API and storage postconditions") + require(start <= legacy.timestamp(row["postcondition"]["observedAt"]) <= end, + "isolation postcondition is outside its case") + row.update(verifiedAssertions=names, verifiedSurfaces=surfaces, + wireStatus=result.get("status"), wireHttpStatus=response.get("httpStatus")) + self.case_cache[identity] = row + return super().case(identity, kind, operation) + + +PREREQUISITES = { + "release_identity": ["version_source_and_digests_match", "live_catalog_matches"], + "authority": ["explicit_owner_grant_observed", "ordinary_actor_stays_scoped"], + "baseline": ["owned_fixture_registry_ready", "settings_and_unrelated_record_baseline_captured"], + "mail": ["ready_global_sender", "owned_recipient_capture", "unrelated_queue_isolated", "outbox_read_access"], + "netratel": ["exact_target_online", "current_target_profile_revision", "tenant_visibility_and_policy_admitted", "paired_m2m_healthy"], + "netclaw": ["saved_pairing_authenticates", "actual_provider_reply_observed"], + "graph_dataset": ["approved_graph_fixture_available"], + "customer_authentication": ["mode_specific_account_fixture_ready"], +} + + +def prerequisite_template(): + return {"format": "rateldesk-beta11-prerequisites/v1", "authenticationMode": None, + "items": [{"id": name, "state": "NOT_CHECKED", "observedAt": None, + "assertions": [{"id": key, "evidence": None, "pointer": None, "expected": None} + for key in assertions], "affectedCases": [], "nextAction": None} + for name, assertions in PREREQUISITES.items()]} + + +def check_prerequisites(data, evidence_root): + require(data.get("format") == "rateldesk-beta11-prerequisites/v1", "unexpected prerequisite format") + require(data.get("authenticationMode") in {"Local", "Authentik"}, "record the observed authentication mode") + rows = legacy.index(data.get("items"), "prerequisite") + require(set(rows) == set(PREREQUISITES), "prerequisite checklist is incomplete") + # Reuse the same bounded, hashed, no-traversal evidence reader as final validation. + reader = object.__new__(legacy.Validator) + reader.root, reader.files, reader.bytes = evidence_root.resolve(), {}, 0 + missing = [] + for name, required in PREREQUISITES.items(): + row = rows[name] + if row.get("state") != "READY": + missing.append({"id": name, "state": row.get("state"), "affectedCases": row.get("affectedCases", [])}) + continue + at = legacy.timestamp(row.get("observedAt")) + require(at <= datetime.now(timezone.utc), "prerequisite observation is in the future") + assertions = legacy.index(row.get("assertions"), "prerequisite assertion") + require(set(assertions) == set(required), "required prerequisite assertion is missing") + for assertion in assertions.values(): + evidence = reader.evidence(assertion.get("evidence")) + require(assertion.get("expected") is True and + json.dumps(legacy.pointer(evidence, assertion.get("pointer")), sort_keys=True) + == json.dumps(assertion["expected"], sort_keys=True), + "prerequisite assertion contradicts its capture") + return {"ready": not missing, "missing": missing, + "scope": "Prerequisite evidence only; no operation or production acceptance implied"} + + +def progress(receipt, catalog_path): + _, expected = export_catalog(catalog_path) + rows = legacy.index(receipt.get("operations"), "operation") + require(set(rows) == set(expected), "progress ledger must contain every beta.11 operation exactly once") + states = {} + incomplete = [] + for identity, row in rows.items(): + state = row.get("state", "NOT_RUN") + states[state] = states.get(state, 0) + 1 + allowed_exclusion = identity in legacy.HTTP_EXCLUSIONS or ( + receipt.get("campaign", {}).get("authenticationMode") == "Local" and identity in legacy.LOCAL_EQUIVALENTS) + required = ("guardCaseId", "equivalentCaseId") if state == "EXCLUDED" and identity in legacy.LOCAL_EQUIVALENTS else ( + ("guardCaseId",) if state == "EXCLUDED" else ("positiveCaseId",)) + if state == "PASS" and expected[identity]["confirmationRequired"]: + required += ("previewCaseId",) + if state == "PASS" and expected[identity].get("boundedIntegrationCredential", {}).get("support") == "denied_by_policy": + required += ("denialCaseId",) + if state not in {"PASS", "EXCLUDED"} or (state == "EXCLUDED" and not allowed_exclusion) or any( + not row.get(key) or row[key] not in receipt.get("cases", {}) for key in required): + incomplete.append(identity) + spec = legacy.contract() + def missing_mappings(name, requirements): + actual = legacy.index(receipt.get(name), name) + require(set(actual) == {row["id"] for row in requirements}, "required " + name + " rows are missing") + return [row["id"] + "/" + case for row in requirements for case in row["cases"] + if not actual[row["id"]].get("cases", {}).get(case) + or actual[row["id"]]["cases"][case] not in receipt.get("cases", {})] + return {"readiness": "NOT_VALIDATED", "operationCount": len(expected), "recordedStates": states, + "operationsNeedingEvidence": incomplete, + "domainMappingsNeeded": missing_mappings("scenarios", spec["scenarios"]), + "historicalMappingsNeeded": missing_mappings("historicalObligations", spec["historicalObligations"]), + "functionalCompletedAt": receipt.get("campaign", {}).get("functionalCompletedAt"), + "transportBoundaryRecorded": receipt.get("transportBoundary") is not None, + "soakRecorded": receipt.get("soak") is not None, "cleanupRecorded": receipt.get("cleanup") is not None, + "scope": "Planning inventory; recorded PASS labels have not been validated"} + + +def initialize(directory, catalog_path): + require(not directory.exists(), "refusing to overwrite or merge an existing campaign workspace") + receipt = legacy.template(catalog_path) + receipt["transportBoundary"] = None + receipt["transportLimitConfiguration"] = None + directory.mkdir(mode=0o700, parents=False) + files = {"receipt.json": receipt, "prerequisites.json": prerequisite_template(), + "fixture-registry.json": {"format": "rateldesk-beta11-fixtures/v1", "campaignId": None, + "baseline": None, "fixtures": [], "settings": [], "uncertainEffects": []}} + for name, data in files.items(): + (directory / name).write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8") + return {"readiness": "NOT_RUN", "operations": len(receipt["operations"]), + "domainCases": sum(len(row["cases"]) for row in receipt["scenarios"]), + "historicalObligations": len(receipt["historicalObligations"]), "created": list(files)} + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("mode", choices=("init", "status", "check-prerequisites", "validate")) + parser.add_argument("--catalog", type=Path, required=True) + parser.add_argument("--manifest", type=Path) + parser.add_argument("--receipt", type=Path) + parser.add_argument("--prerequisites", type=Path) + parser.add_argument("--evidence-root", type=Path) + parser.add_argument("--output", type=Path) + args = parser.parse_args() + try: + export_catalog(args.catalog) + if args.mode == "init": + require(args.output is not None, "init requires a new private --output directory") + require(not args.output.resolve().is_relative_to(Path(__file__).resolve().parents[2]), + "campaign workspace must be outside the checkout") + result = initialize(args.output, args.catalog) + elif args.mode == "status": + require(args.receipt is not None, "status requires --receipt") + result = progress(read_json(args.receipt), args.catalog) + elif args.mode == "check-prerequisites": + require(args.prerequisites is not None and args.evidence_root is not None, + "check-prerequisites requires --prerequisites and --evidence-root") + result = check_prerequisites(read_json(args.prerequisites), args.evidence_root) + else: + require(args.manifest is not None and args.receipt is not None and args.evidence_root is not None, + "validate requires --manifest, --receipt and --evidence-root") + result = Validator(read_json(args.receipt), args.evidence_root, args.catalog, args.manifest).validate() + print(json.dumps(result, indent=2)) + return 1 if result.get("ready") is False else 0 + except (Invalid, OSError, ValueError, KeyError, TypeError, IndexError, RecursionError, legacy.ET.ParseError) as error: + # No raw capture bodies or private selector values in diagnostics. + message = str(error) if isinstance(error, Invalid) else type(error).__name__ + message = {"candidate version must be exactly beta.8": "candidate version must be exactly beta.11", + "catalog is not the beta.8 owner-operation revision": "catalog is not the beta.11 owner-operation revision"}.get(message, message) + print("NOT_READY: " + message, file=sys.stderr) + return 1 + + +if __name__ == "__main__": + raise SystemExit(main())