API key scopes

Every API key holds scopes, and every operation it can reach needs one of them. A key that lacks the scope an operation needs is refused with INSUFFICIENT_SCOPE, which names the missing scope. A scope ending in :write also grants the matching :read scope.

org:read

Read the organization's org units through the public API.

Kind:read

• GET /api/public/v1/org-units

org:write

Create, change and delete org units through the public API.

Kind: write · Also grants: org:read

• POST /api/public/v1/org-units
• DELETE /api/public/v1/org-units/{unit_id}
• PATCH /api/public/v1/org-units/{unit_id}

zones:read

Read Autonomy Zones, their Ask behaviour, their dictionary and agents' zone assignments through the public API.

Kind:read

• GET /api/public/v1/agents/{agent_id}/zone
• GET /api/public/v1/org-units/{unit_id}/zone/preview
• GET /api/public/v1/zones
• GET /api/public/v1/zones/{zone_id}
• GET /api/public/v1/zones/{zone_id}/agents
• GET /api/public/v1/zones/{zone_id}/ask-settings
• GET /api/public/v1/zones/{zone_id}/dictionary

zones:write

Create and change Autonomy Zones, their Ask behaviour and their dictionary, and assign agents to zones through the public API.

Kind: write · Also grants: zones:read

• DELETE /api/public/v1/agents/{agent_id}/zone
• PUT /api/public/v1/agents/{agent_id}/zone
• POST /api/public/v1/org-units/{unit_id}/zone
• DELETE /api/public/v1/zones/{zone_id}
• PATCH /api/public/v1/zones/{zone_id}/ask-settings
• DELETE /api/public/v1/zones/{zone_id}/default
• PUT /api/public/v1/zones/{zone_id}/default
• POST /api/public/v1/zones/{zone_id}/dictionary/tables
• DELETE /api/public/v1/zones/{zone_id}/dictionary/tables/{name}
• DELETE /api/public/v1/zones/{zone_id}/dictionary/tables/{name}/values
• POST /api/public/v1/zones/{zone_id}/dictionary/tables/{name}/values

policies:read

Read intent policies and stated policy through the public API.

Kind:read

• GET /api/public/v1/policies/{public_id}
• GET /api/public/v1/zones/{zone_id}/policies

policies:write

Change intent policies and stated policy through the public API.

Kind: write · Also grants: policies:read

• POST /api/public/v1/policies/stated
• DELETE /api/public/v1/policies/{public_id}
• PATCH /api/public/v1/policies/{public_id}
• PATCH /api/public/v1/policies/{public_id}/ask-settings
• POST /api/public/v1/policies/{public_id}/copy
• POST /api/public/v1/policies/{public_id}/edit
• DELETE /api/public/v1/policies/{public_id}/intent-policies/{intent_policy_id}/cases/{case_id}
• DELETE /api/public/v1/policies/{public_id}/intent-policies/{intent_policy_id}/decisive
• POST /api/public/v1/policies/{public_id}/promote
• PATCH /api/public/v1/policies/{public_id}/title
• POST /api/public/v1/policies/{public_id}/versions/{version}/apply
• POST /api/public/v1/zones/{zone_id}/policy-attachments
• DELETE /api/public/v1/zones/{zone_id}/policy-attachments/{public_id}

proposals:read

Read learning proposals through the public API.

Kind:read

• GET /api/public/v1/learning-proposals
• GET /api/public/v1/learning-proposals/{public_id}

proposals:write

Accept and dismiss learning proposals through the public API.

Kind: write · Also grants: proposals:read

• POST /api/public/v1/learning-proposals/{public_id}/accept
• POST /api/public/v1/learning-proposals/{public_id}/dismiss

presets:read

Read the organization's policy presets and their rules through the public API.

Kind:read

• GET /api/public/v1/policy-presets

presets:write

Change the organization's policy presets and their rules through the public API.

Kind: write · Also grants: presets:read

• POST /api/public/v1/policy-presets
• DELETE /api/public/v1/policy-presets/{key}
• PATCH /api/public/v1/policy-presets/{key}
• POST /api/public/v1/policy-presets/{key}/rules
• DELETE /api/public/v1/policy-presets/{key}/rules/{rule_id}

aip:read

Read Agent Intent Policy authoring through the public API (beta).

Kind:read

• GET /api/public/v1/aip/authoring-metadata
• GET /api/public/v1/aip/drafts/{public_id}
• GET /api/public/v1/aip/jobs/{job_id}

aip:write

Author Agent Intent Policies through the public API (beta).

Kind: write · Also grants: aip:read

• POST /api/public/v1/aip/drafts
• DELETE /api/public/v1/aip/drafts/{public_id}
• PATCH /api/public/v1/aip/drafts/{public_id}
• DELETE /api/public/v1/aip/drafts/{public_id}/intent-policies/{intent_policy_id}
• PATCH /api/public/v1/aip/drafts/{public_id}/intent-policies/{intent_policy_id}
• POST /api/public/v1/aip/drafts/{public_id}/intent-policies/{intent_policy_id}/answers
• PATCH /api/public/v1/aip/drafts/{public_id}/intent-policies/{intent_policy_id}/cases/{index}
• POST /api/public/v1/aip/drafts/{public_id}/intent-policies/{intent_policy_id}/fix
• POST /api/public/v1/aip/drafts/{public_id}/intent-policies/{intent_policy_id}/fix/apply
• POST /api/public/v1/aip/drafts/{public_id}/prepare
• POST /api/public/v1/aip/drafts/{public_id}/ratify
• POST /api/public/v1/aip/drafts/{public_id}/replay
• POST /api/public/v1/aip/sources

triage:read

Read anomalies, Ask grounds and holds through the public API.

Kind:read

• GET /api/public/v1/anomalies
• GET /api/public/v1/anomalies/{public_id}
• GET /api/public/v1/asks
• GET /api/public/v1/holds

triage:write

Answer anomalies, Ask grounds and holds through the public API.

Kind: write · Also grants: triage:read

• PATCH /api/public/v1/anomalies/{public_id}
• POST /api/public/v1/asks/{ground_id}/answer
• POST /api/public/v1/asks/{ground_id}/snooze
• POST /api/public/v1/holds/{native_tool_use_id}/answer

alerts:read

Read security alerts through the public API.

Kind:read

• GET /api/public/v1/alerts

alerts:write

Change security alerts through the public API.

Kind: write · Also grants: alerts:read

• DELETE /api/public/v1/alerts/{alert_id}
• PATCH /api/public/v1/alerts/{alert_id}/dismiss
• PATCH /api/public/v1/alerts/{alert_id}/read
• PATCH /api/public/v1/alerts/{alert_id}/restore
• PATCH /api/public/v1/alerts/{alert_id}/unread

agents:read

Read agents, their ownership, sessions, execution graph and inventory sessions through the public API.

Kind:read

• GET /api/public/v1/agents
• GET /api/public/v1/agents/{agent_id}
• GET /api/public/v1/agents/{agent_id}/execution-graph
• GET /api/public/v1/agents/{agent_id}/execution-graph/node-events
• GET /api/public/v1/agents/{agent_id}/ownership
• GET /api/public/v1/agents/{agent_id}/ownership/privileges
• GET /api/public/v1/agents/{agent_id}/sessions
• GET /api/public/v1/agents/{agent_id}/sessions/summary
• GET /api/public/v1/inventory/sessions

agents:write

Change agents, their ownership and sessions through the public API.

Kind: write · Also grants: agents:read

• DELETE /api/public/v1/agents/{agent_id}
• PATCH /api/public/v1/agents/{agent_id}
• PATCH /api/public/v1/agents/{agent_id}/ownership
• POST /api/public/v1/agents/{agent_id}/ownership/recheck
• DELETE /api/public/v1/agents/{agent_id}/sessions
• DELETE /api/public/v1/sessions/{session_id}
• PATCH /api/public/v1/sessions/{session_id}

host:run

Run the OpenLatch client on a host: send events, fetch the policy bundle, hold actions for review, poll alerts and read the licence state.

Kind:action

• POST /api/v1/alerts/ack-all
• GET /api/v1/alerts/pending
• POST /api/v1/alerts/{alert_id}/ack
• POST /api/v1/events/ingest
• POST /api/v1/holds
• GET /api/v1/holds/{native_tool_use_id}
• POST /api/v1/hosts/identity
• GET /api/v1/hosts/self
• DELETE /api/v1/hosts/self/credential
• GET /api/v1/license/state
• GET /api/v1/policy/bundle

host:enroll

Enroll a host and receive its host credential.

Kind:action

• POST /api/v1/hosts/enroll

self

Read the key's own user and organization, and revoke the key itself. Every key holds it.

Kind: implicit · You cannot grant it when you create a key.

• GET /api/public/v1/users/me/context
• DELETE /api/v1/api-keys/self
• GET /api/v1/users/me
• DELETE /api/v1/users/me/api-keys/self

legacy

Full access (legacy): every operation the key reached before scopes. Held only by keys created before scopes, never combined with another scope.

Kind: marker · You cannot grant it when you create a key.

An operation listed under no scope is not available to scoped keys: only a Full access (legacy) key reaches it.