Status: 104 capabilities — 20 GA, 84 Beta. Enforcement is monitor-only by default. Honest status →
USCP
API reference

508 operations, every one entitlement-gated

Generated from the OpenAPI contract the binary itself serves. A CI gate fails the build if a registered route is missing from this contract, so the list below cannot quietly drift from the running product.

Also available live from any deployment at /v1/openapi.yaml, with capability discovery at /.well-known/api-capabilities.

1

MethodPathSummary
GET/admin console SPA + embedded static assets (§8; more-specific routes win)

.well-known 4

MethodPathSummary
GET/.well-known/api-capabilities§53 capability matrix discovery (free-tier; platform.capability_discovery)
GET/.well-known/federationfederation topology (§40 free-tier)
GET/.well-known/openapi.jsonOpenAPI contract pointer (§40 free-tier)
GET/.well-known/security.txtRFC 9116 security contact (§40 free-tier)

_audit 2

MethodPathSummary
GET/v1/_audit/activityRequires entitlement control_plane.shell
GET/v1/_audit/verifyRequires entitlement control_plane.shell

admin 4

MethodPathSummary
POST/admin/break-glass§98 IdP-independent break-glass — never entitlement-gated
POST/admin/break-glass/setupRequires entitlement control_plane.shell
GET/v1/admin/log-levelRequires entitlement control_plane.shell
PUT/v1/admin/log-levelRequires entitlement control_plane.shell

ai 4

MethodPathSummary
GET/v1/ai/modelsList registered AI models (§13)
POST/v1/ai/modelsRegister an AI model card (§13)
POST/v1/ai/models/{id}/promoteAdvance a model's governance lifecycle (§13)
POST/v1/ai/models/{id}/retireRetire an AI model (§13)

aiops 3

MethodPathSummary
GET/v1/aiops/anomaliesRequires entitlement control_plane.aiops
GET/v1/aiops/healthRequires entitlement control_plane.aiops
POST/v1/aiops/scanRequires entitlement control_plane.aiops

analytics 2

MethodPathSummary
GET/v1/analytics/datasetsRequires entitlement control_plane.shell
POST/v1/analytics/queryRequires entitlement control_plane.shell

asyncapi.yaml 1

MethodPathSummary
GET/asyncapi.yamlAsyncAPI 3.0 event contract (§7)

audit 5

MethodPathSummary
GET/v1/audit/auditor-grantsRequires entitlement control_plane.shell
POST/v1/audit/auditor-grantsRequires entitlement control_plane.shell
DELETE/v1/audit/auditor-grants/{subject}Requires entitlement control_plane.shell
GET/v1/audit/evidence-lockerRequires entitlement platform.customer_auditor_role
GET/v1/audit/evidence-locker/exportRequires entitlement platform.customer_auditor_role

auth 12

MethodPathSummary
GET/auth/callbackpre-auth OIDC callback (bootstrap exemption §36)
POST/auth/local/loginlocal-account login (pre-auth; admin-enabled)
GET/auth/loginBegin OIDC SSO (redirects to IdP)
POST/auth/logoutsession teardown
POST/auth/saml/acsSAML assertion consumer service (pre-auth)
GET/auth/saml/metadataSP SAML metadata for IdP registration (pre-auth)
GET/auth/saml/{id}/loginstart SAML SSO for a provider (pre-auth)
GET/auth/ssoemail-domain home-realm discovery → per-tenant IdP (pre-auth)
POST/auth/webauthn/login/beginMFA verification during auth (§3/§18)
POST/auth/webauthn/login/finishMFA verification during auth (§3/§18)
POST/auth/webauthn/register/beginMFA enrolment during auth (§3/§18)
POST/auth/webauthn/register/finishMFA enrolment during auth (§3/§18)

collab 3

MethodPathSummary
GET/v1/collab/{doc}Requires entitlement control_plane.shell
POST/v1/collab/{doc}/opRequires entitlement control_plane.shell
GET/v1/collab/{doc}/streamRequires entitlement control_plane.shell

collective 4

MethodPathSummary
GET/v1/collective/iocsRequires entitlement control_plane.collective_defense
POST/v1/collective/iocsRequires entitlement control_plane.collective_defense
POST/v1/collective/optinRequires entitlement control_plane.collective_defense
GET/v1/collective/statusRequires entitlement control_plane.collective_defense

config-drift 4

MethodPathSummary
GET/v1/config-drift/baselinesRequires entitlement control_plane.config_drift
POST/v1/config-drift/baselinesRequires entitlement control_plane.config_drift
POST/v1/config-drift/checkRequires entitlement control_plane.config_drift
GET/v1/config-drift/driftsRequires entitlement control_plane.config_drift

contracts 2

MethodPathSummary
GET/v1/contractsRequires entitlement platform.contract_registry
GET/v1/contracts/{name}Requires entitlement platform.contract_registry

correlation 3

MethodPathSummary
GET/v1/correlation/incidentsRequires entitlement control_plane.correlation
GET/v1/correlation/liveRequires entitlement control_plane.correlation
POST/v1/correlation/runRequires entitlement control_plane.correlation

crypto 1

MethodPathSummary
GET/v1/crypto/statuscrypto manifest + FIPS mode + PQC readiness (§19 free-tier)

ctem 9

MethodPathSummary
POST/v1/ctem/assessRequires entitlement control_plane.exposure_mgmt
GET/v1/ctem/assessmentsList CTEM assessments (cursor-paginated)
POST/v1/ctem/attack-pathRequires entitlement control_plane.attack_path
POST/v1/ctem/cve-feedRequires entitlement control_plane.exposure_mgmt
POST/v1/ctem/cve-feed/fetchPull live CVEs from NVD/OSV into the tenant feed
GET/v1/ctem/exposuresRequires entitlement control_plane.exposure_mgmt
GET/v1/ctem/scopeRequires entitlement control_plane.exposure_mgmt
POST/v1/ctem/validateRequires entitlement control_plane.validation_bas
GET/v1/ctem/vectorsRequires entitlement control_plane.exposure_mgmt

data-ops 3

MethodPathSummary
POST/v1/data-ops/export-snapshotRequires entitlement platform.self_service_data_ops
GET/v1/data-ops/jobsRequires entitlement platform.self_service_data_ops
POST/v1/data-ops/purgeRequires entitlement platform.self_service_data_ops

deception 5

MethodPathSummary
GET/v1/deception/honeytokensRequires entitlement control_plane.deception
POST/v1/deception/honeytokensRequires entitlement control_plane.deception
DELETE/v1/deception/honeytokens/{id}Requires entitlement control_plane.deception
POST/v1/deception/tripRequires entitlement control_plane.deception
GET/v1/deception/tripsRequires entitlement control_plane.deception

detect 8

MethodPathSummary
GET/v1/detect/findingsRequires entitlement control_plane.detection_hub
POST/v1/detect/findings/{id}/escalateRequires entitlement control_plane.detection_hub
GET/v1/detect/rulesRequires entitlement control_plane.detection_hub
POST/v1/detect/rulesRequires entitlement control_plane.detection_hub
POST/v1/detect/rules/import-sigmaRequires entitlement control_plane.detection_hub
POST/v1/detect/rules/install-startersRequires entitlement control_plane.detection_hub
POST/v1/detect/rules/testRequires entitlement control_plane.detection_hub
DELETE/v1/detect/rules/{id}Requires entitlement control_plane.detection_hub

detections 3

MethodPathSummary
GET/v1/detectionsList detections (cursor-paginated, det_id keyset)
POST/v1/detectionsUpsert a detection
GET/v1/detections/coverageRequires entitlement control_plane.attack_coverage_map

detonation 3

MethodPathSummary
GET/v1/detonation/jobsRequires entitlement control_plane.detonation
GET/v1/detonation/providerRequires entitlement control_plane.detonation
POST/v1/detonation/submitRequires entitlement control_plane.detonation

dlp 5

MethodPathSummary
GET/v1/dlp/egress-eventsRequires entitlement control_plane.dlp
GET/v1/dlp/rulesList DLP detectors (built-in + tenant) (§104)
POST/v1/dlp/rulesCreate/update a tenant DLP detector (§104)
DELETE/v1/dlp/rules/{id}Delete a tenant DLP detector (§104)
POST/v1/dlp/scanScan content for a DLP verdict allow/redact/block (§104)

drp 5

MethodPathSummary
GET/v1/drp/assetsRequires entitlement control_plane.drp
POST/v1/drp/assetsRequires entitlement control_plane.drp
GET/v1/drp/findingsRequires entitlement control_plane.drp
POST/v1/drp/ingestRequires entitlement control_plane.drp
POST/v1/drp/simulateRequires entitlement control_plane.drp

dualcontrol 3

MethodPathSummary
GET/v1/dualcontrolRequires entitlement control_plane.shell
POST/v1/dualcontrol/{id}/approveRequires entitlement control_plane.shell
POST/v1/dualcontrol/{id}/rejectRequires entitlement control_plane.shell

estate 29

MethodPathSummary
POST/v1/estate/agent/pollagent check-in: pull queued commands (agent-token authed, §89)
POST/v1/estate/agent/resultagent check-in: post command result (agent-token authed, §89)
GET/v1/estate/agentsRequires entitlement control_plane.estate_inventory
POST/v1/estate/agents/enrollRequires entitlement control_plane.estate_inventory
GET/v1/estate/breakglassRequires entitlement control_plane.session_broker
POST/v1/estate/breakglass/requestRequires entitlement control_plane.session_broker
POST/v1/estate/breakglass/{id}/approveRequires entitlement control_plane.session_broker
GET/v1/estate/capabilitiesRequires entitlement control_plane.estate_inventory
GET/v1/estate/config-appliedRequires entitlement control_plane.estate_inventory
GET/v1/estate/credential-providersRequires entitlement control_plane.estate_pam
GET/v1/estate/credentialsRequires entitlement control_plane.estate_pam
POST/v1/estate/credentialsRequires entitlement control_plane.estate_pam
DELETE/v1/estate/credentials/{id}Requires entitlement control_plane.estate_pam
POST/v1/estate/fanoutRequires entitlement control_plane.estate_response
GET/v1/estate/host-keysRequires entitlement control_plane.estate_inventory
POST/v1/estate/host-keys/resetRequires entitlement control_plane.estate_inventory
POST/v1/estate/killswitchRequires entitlement control_plane.estate_response
POST/v1/estate/killswitch/resetRequires entitlement control_plane.estate_response
POST/v1/estate/packs/applyRequires entitlement control_plane.estate_policy
POST/v1/estate/packs/planRequires entitlement control_plane.estate_policy
GET/v1/estate/pam-connectorsRequires entitlement control_plane.estate_pam
POST/v1/estate/pam-connectorsRequires entitlement control_plane.estate_pam
DELETE/v1/estate/pam-connectors/{id}Requires entitlement control_plane.estate_pam
POST/v1/estate/sessionsRequires entitlement control_plane.session_broker
POST/v1/estate/sessions/{id}/execRequires entitlement control_plane.session_broker
GET/v1/estate/sessions/{id}/recordingRequires entitlement control_plane.session_broker
GET/v1/estate/targetsList estate targets (cursor-paginated)
POST/v1/estate/targetsRequires entitlement control_plane.estate_inventory
GET/v1/estate/topologyRequires entitlement control_plane.estate_inventory

events 2

MethodPathSummary
POST/v1/events/emitRequires entitlement control_plane.shell
GET/v1/events/streamRequires entitlement control_plane.shell

federation 8

MethodPathSummary
GET/v1/federation/childrenList federated child instances (§37/§49)
POST/v1/federation/childrenRegister a child instance under this parent (§37/§49)
DELETE/v1/federation/children/{id}Deregister a child instance (§37/§49)
GET/v1/federation/children/{id}Requires entitlement suite.federation_core
POST/v1/federation/children/{id}/heartbeatRequires entitlement suite.federation_core
GET/v1/federation/healthAggregate federation health across children (§37/§49)
GET/v1/federation/openapiRequires entitlement platform.federation_openapi
GET/v1/federation/postureRequires entitlement suite.federation_core

fleets 5

MethodPathSummary
GET/v1/fleetsRequires entitlement control_plane.fleet_mgmt
POST/v1/fleetsRequires entitlement control_plane.fleet_mgmt
DELETE/v1/fleets/{id}Requires entitlement control_plane.fleet_mgmt
GET/v1/fleets/{id}Requires entitlement control_plane.fleet_mgmt
POST/v1/fleets/{id}/membersRequires entitlement control_plane.fleet_mgmt

geo-fence 2

MethodPathSummary
GET/v1/geo-fenceRequires entitlement control_plane.shell
PUT/v1/geo-fenceRequires entitlement control_plane.shell

healthz 2

MethodPathSummary
GET/healthzLiveness probe (free-tier)
GET/healthz/deepdeep dependency health (per-component; free-tier)

iam 33

MethodPathSummary
GET/v1/iam/auth-settingsRequires entitlement control_plane.shell
PUT/v1/iam/auth-settingsRequires entitlement control_plane.shell
GET/v1/iam/external-backendsRequires entitlement control_plane.shell
PUT/v1/iam/external-backendsRequires entitlement control_plane.shell
GET/v1/iam/idpsRequires entitlement control_plane.shell
POST/v1/iam/idpsRequires entitlement control_plane.shell
DELETE/v1/iam/idps/{id}Requires entitlement control_plane.shell
GET/v1/iam/ip-allowlistRequires entitlement control_plane.shell
PUT/v1/iam/ip-allowlistRequires entitlement control_plane.shell
GET/v1/iam/local-usersRequires entitlement control_plane.shell
POST/v1/iam/local-usersRequires entitlement control_plane.shell
DELETE/v1/iam/local-users/{username}Requires entitlement control_plane.shell
POST/v1/iam/local-users/{username}/passwordRequires entitlement control_plane.shell
GET/v1/iam/rbac/effectiveRequires entitlement control_plane.shell
GET/v1/iam/rbac/grantsRequires entitlement control_plane.shell
DELETE/v1/iam/rbac/roles/{role}Requires entitlement control_plane.shell
PUT/v1/iam/rbac/roles/{role}Requires entitlement control_plane.shell
GET/v1/iam/rbac/settingsRequires entitlement control_plane.shell
PUT/v1/iam/rbac/settingsRequires entitlement control_plane.shell
GET/v1/iam/role-mappingsRequires entitlement control_plane.shell
PUT/v1/iam/role-mappingsRequires entitlement control_plane.shell
GET/v1/iam/saml-idpsRequires entitlement control_plane.shell
POST/v1/iam/saml-idpsRequires entitlement control_plane.shell
DELETE/v1/iam/saml-idps/{id}Requires entitlement control_plane.shell
GET/v1/iam/service-tokensRequires entitlement control_plane.shell
POST/v1/iam/service-tokensRequires entitlement control_plane.shell
DELETE/v1/iam/service-tokens/{id}Requires entitlement control_plane.shell
POST/v1/iam/service-tokens/{id}/rotateRequires entitlement control_plane.shell
GET/v1/iam/sessionsRequires entitlement control_plane.shell
POST/v1/iam/sessions/revoke-othersRequires entitlement control_plane.shell
DELETE/v1/iam/sessions/{id}Requires entitlement control_plane.shell
POST/v1/iam/totp/enrollRequires entitlement control_plane.shell
POST/v1/iam/totp/verifyRequires entitlement control_plane.shell

iga 5

MethodPathSummary
GET/v1/iga/campaignsRequires entitlement control_plane.access_certification
POST/v1/iga/certifyRequires entitlement control_plane.access_certification
POST/v1/iga/joinerRequires entitlement control_plane.iga
POST/v1/iga/leaverRequires entitlement control_plane.iga
POST/v1/iga/sod/checkRequires entitlement control_plane.sod

integrations 33

MethodPathSummary
GET/v1/integrations/approvalsRequires entitlement control_plane.device_blueprints
POST/v1/integrations/approvals/{id}/approveRequires entitlement control_plane.device_blueprints
POST/v1/integrations/approvals/{id}/rejectRequires entitlement control_plane.device_blueprints
GET/v1/integrations/blueprintsRequires entitlement control_plane.device_blueprints
POST/v1/integrations/blueprints/importRequires entitlement control_plane.device_blueprints
POST/v1/integrations/blueprints/import-urlRequires entitlement control_plane.device_blueprints
DELETE/v1/integrations/blueprints/{id}Requires entitlement control_plane.device_blueprints
GET/v1/integrations/blueprints/{id}Requires entitlement control_plane.device_blueprints
GET/v1/integrations/blueprints/{id}/diffRequires entitlement control_plane.device_blueprints
POST/v1/integrations/blueprints/{id}/validate-sampleRequires entitlement control_plane.device_blueprints
GET/v1/integrations/call-quotaRequires entitlement control_plane.device_blueprints
PUT/v1/integrations/call-quotaRequires entitlement control_plane.device_blueprints
GET/v1/integrations/devicesRequires entitlement control_plane.device_blueprints
POST/v1/integrations/devicesRequires entitlement control_plane.device_blueprints
GET/v1/integrations/devices/exportRequires entitlement control_plane.device_blueprints
DELETE/v1/integrations/devices/{id}Requires entitlement control_plane.device_blueprints
PUT/v1/integrations/devices/{id}Requires entitlement control_plane.device_blueprints
POST/v1/integrations/devices/{id}/callRequires entitlement control_plane.device_blueprints
GET/v1/integrations/devices/{id}/callsRequires entitlement control_plane.device_blueprints
PUT/v1/integrations/devices/{id}/credentialsRequires entitlement control_plane.device_blueprints
PUT/v1/integrations/devices/{id}/endpoint-versionRequires entitlement control_plane.device_blueprints
POST/v1/integrations/devices/{id}/healthRequires entitlement control_plane.device_blueprints
PUT/v1/integrations/devices/{id}/limitsRequires entitlement control_plane.device_blueprints
PUT/v1/integrations/devices/{id}/tagsRequires entitlement control_plane.device_blueprints
GET/v1/integrations/egress-allowlistRequires entitlement control_plane.device_blueprints
POST/v1/integrations/egress-allowlistRequires entitlement control_plane.device_blueprints
DELETE/v1/integrations/egress-allowlist/{id}Requires entitlement control_plane.device_blueprints
POST/v1/integrations/fleet/callRequires entitlement control_plane.device_blueprints
GET/v1/integrations/schedulesRequires entitlement control_plane.device_blueprints
POST/v1/integrations/schedulesRequires entitlement control_plane.device_blueprints
DELETE/v1/integrations/schedules/{id}Requires entitlement control_plane.device_blueprints
PUT/v1/integrations/schedules/{id}Requires entitlement control_plane.device_blueprints
POST/v1/integrations/schedules/{id}/run-nowRequires entitlement control_plane.device_blueprints

intel 5

MethodPathSummary
GET/v1/intel/collections/{id}/objectsRequires entitlement control_plane.threat_intel
GET/v1/intel/indicatorsRequires entitlement control_plane.threat_intel
POST/v1/intel/indicatorsRequires entitlement control_plane.threat_intel
POST/v1/intel/indicators/{id}/suppressRequires entitlement control_plane.threat_intel
POST/v1/intel/indicators/{id}/unsuppressRequires entitlement control_plane.threat_intel

itdr 3

MethodPathSummary
GET/v1/itdr/detectionsRequires entitlement control_plane.itdr
POST/v1/itdr/scanRequires entitlement control_plane.itdr
GET/v1/itdr/signalsRequires entitlement control_plane.itdr

itsm 5

MethodPathSummary
GET/v1/itsm/connectorsRequires entitlement control_plane.shell
POST/v1/itsm/connectorsRequires entitlement control_plane.shell
DELETE/v1/itsm/connectors/{id}Requires entitlement control_plane.shell
POST/v1/itsm/connectors/{id}/pushRequires entitlement control_plane.shell
POST/v1/itsm/connectors/{id}/testRequires entitlement control_plane.shell

lake 2

MethodPathSummary
POST/v1/lake/ingestRequires entitlement control_plane.security_data_lake
POST/v1/lake/queryRequires entitlement control_plane.federated_search

licensing 6

MethodPathSummary
GET/v1/licensing/airgapRequires entitlement platform.airgap_licensing
GET/v1/licensing/continuity§97 continuity/escrow posture (free-tier)
POST/v1/licensing/continuity/activateRequires entitlement platform.continuity_escrow
GET/v1/licensing/mtls-profileRequires entitlement platform.mtls_license_profile
GET/v1/licensing/onlineRequires entitlement platform.online_licensing
GET/v1/licensing/statusLicensing posture (visible without egress, §36)

livez 1

MethodPathSummary
GET/livezliveness probe (free-tier)

lockbox 9

MethodPathSummary
GET/v1/lockbox/byokRequires entitlement platform.byok_envelope
POST/v1/lockbox/hyok/decryptRequires entitlement platform.hyok
POST/v1/lockbox/hyok/encryptRequires entitlement platform.hyok
POST/v1/lockbox/hyok/provisionRequires entitlement platform.hyok
POST/v1/lockbox/hyok/revokeRequires entitlement platform.hyok
GET/v1/lockbox/hyok/statusRequires entitlement platform.hyok
GET/v1/lockbox/requestsRequires entitlement platform.customer_lockbox
POST/v1/lockbox/requestsRequires entitlement platform.customer_lockbox
POST/v1/lockbox/requests/{id}/decisionRequires entitlement platform.customer_lockbox

logs 12

MethodPathSummary
GET/v1/logs/collectorsRequires entitlement control_plane.shell
POST/v1/logs/collectorsRequires entitlement control_plane.shell
DELETE/v1/logs/collectors/{id}Requires entitlement control_plane.shell
GET/v1/logs/exportTenant-scoped log export (NDJSON, §6)
GET/v1/logs/flowsRequires entitlement control_plane.shell
POST/v1/logs/ingestRequires entitlement control_plane.shell
GET/v1/logs/investigationsRequires entitlement control_plane.shell
POST/v1/logs/investigationsRequires entitlement control_plane.shell
DELETE/v1/logs/investigations/{id}Requires entitlement control_plane.shell
GET/v1/logs/searchRequires entitlement control_plane.shell
POST/v1/logs/seedRequires entitlement control_plane.shell
GET/v1/logs/topologyRequires entitlement control_plane.shell

marketplace 1

MethodPathSummary
GET/v1/marketplace/catalog§39 marketplace catalog (free-tier browse)

mcp 1

MethodPathSummary
POST/v1/mcpRequires entitlement control_plane.shell

me 1

MethodPathSummary
GET/v1/meCurrent principal (RBAC + entitlement checked)

metering 3

MethodPathSummary
GET/v1/metering/eventsRequires entitlement control_plane.shell
POST/v1/metering/exportRequires entitlement platform.customer_auditor_role
GET/v1/metering/rollupRequires entitlement control_plane.shell

metrics 1

MethodPathSummary
GET/metrics§6 Prometheus scrape endpoint (protect at the network layer)

migrate 3

MethodPathSummary
POST/v1/migrate/importRequires entitlement control_plane.competitor_migration
GET/v1/migrate/jobsRequires entitlement control_plane.competitor_migration
GET/v1/migrate/sourcesRequires entitlement control_plane.competitor_migration

modules 3

MethodPathSummary
GET/v1/modulesRequires entitlement platform.module_hot_reload
POST/v1/modules/registerRequires entitlement platform.module_hot_reload
POST/v1/modules/{name}/reloadRequires entitlement platform.module_hot_reload

msp 4

MethodPathSummary
GET/v1/msp/managedRequires entitlement control_plane.msp
POST/v1/msp/managedRequires entitlement control_plane.msp
DELETE/v1/msp/managed/{id}Requires entitlement control_plane.msp
GET/v1/msp/socRequires entitlement control_plane.comanaged_soc

notifications 6

MethodPathSummary
GET/v1/notifications/channelsRequires entitlement control_plane.shell
POST/v1/notifications/channelsRequires entitlement control_plane.shell
DELETE/v1/notifications/channels/{id}Requires entitlement control_plane.shell
POST/v1/notifications/channels/{id}/testRequires entitlement control_plane.shell
GET/v1/notifications/deliveriesRequires entitlement control_plane.shell
POST/v1/notifications/deliveries/{id}/replayRequires entitlement control_plane.shell

observability 4

MethodPathSummary
GET/v1/observability/forward-queueRequires entitlement control_plane.shell
POST/v1/observability/forward-queue/replayRequires entitlement control_plane.shell
GET/v1/observability/retentionRequires entitlement control_plane.shell
PUT/v1/observability/retentionRequires entitlement control_plane.shell

openapi.json 1

MethodPathSummary
GET/v1/openapi.jsonOpenAPI JSON for the in-app explorer (§25)

openapi.yaml 1

MethodPathSummary
GET/openapi.yamlOpenAPI 3.1 contract (§25)

org 6

MethodPathSummary
GET/v1/org/childrenRequires entitlement control_plane.shell
POST/v1/org/childrenRequires entitlement control_plane.shell
DELETE/v1/org/children/{id}Requires entitlement control_plane.shell
POST/v1/org/inviteRequires entitlement control_plane.shell
GET/v1/org/parentRequires entitlement control_plane.shell
GET/v1/org/rollupRequires entitlement control_plane.shell

ot 5

MethodPathSummary
GET/v1/ot/assetsRequires entitlement control_plane.ot_visibility
POST/v1/ot/assetsRequires entitlement control_plane.ot_visibility
GET/v1/ot/safety-postureRequires entitlement control_plane.ot_readonly
POST/v1/ot/simulate-seedRequires entitlement control_plane.ot_readonly
GET/v1/ot/zonesRequires entitlement control_plane.ot_visibility

policies 3

MethodPathSummary
GET/v1/policiesList policies (cursor-paginated)
POST/v1/policiesPublish a policy (pending second approver — two-person rule, §3)
POST/v1/policies/{id}/approveApprove/reject a pending policy (distinct approver required)

policy 8

MethodPathSummary
GET/v1/policy/firewallRequires entitlement control_plane.estate_policy
POST/v1/policy/firewallRequires entitlement control_plane.estate_policy
POST/v1/policy/firewall/importRequires entitlement control_plane.estate_policy
GET/v1/policy/firewall/liveRequires entitlement control_plane.estate_policy
DELETE/v1/policy/firewall/{id}Requires entitlement control_plane.estate_policy
PATCH/v1/policy/firewall/{id}Requires entitlement control_plane.estate_policy
POST/v1/policy/firewall/{id}/duplicateRequires entitlement control_plane.estate_policy
POST/v1/policy/simulatePolicy simulator — which precedence layer decides (§3)

policy-twin 4

MethodPathSummary
POST/v1/policy-twin/simulateRequires entitlement control_plane.policy_twin
GET/v1/policy-twin/suitesRequires entitlement control_plane.policy_twin
POST/v1/policy-twin/suitesRequires entitlement control_plane.policy_twin
POST/v1/policy-twin/suites/{id}/runRequires entitlement control_plane.policy_twin

posture 3

MethodPathSummary
GET/v1/posture/historyRequires entitlement control_plane.posture_score
GET/v1/posture/scoreRequires entitlement control_plane.posture_score
POST/v1/posture/snapshotRequires entitlement control_plane.posture_score

privacy 5

MethodPathSummary
GET/v1/privacy/consentList consent receipts (§28)
POST/v1/privacy/consentRecord a consent receipt; honors Sec-GPC opt-out (§28)
POST/v1/privacy/dsar/eraseErase my data (right to erasure)
GET/v1/privacy/dsar/exportExport my data (right of access)
GET/v1/privacy/dsar/requestsDSAR register (cursor-paginated)

rbac 3

MethodPathSummary
GET/v1/rbac/rolesRequires entitlement control_plane.shell
POST/v1/rbac/rolesRequires entitlement control_plane.shell
DELETE/v1/rbac/roles/{name}Requires entitlement control_plane.shell

readyz 1

MethodPathSummary
GET/readyzReadiness probe (free-tier)

release 7

MethodPathSummary
GET/v1/release/assignmentRequires entitlement platform.release_channels
PUT/v1/release/assignmentRequires entitlement platform.release_channels
GET/v1/release/channelsRequires entitlement platform.release_channels
PUT/v1/release/channels/{name}Requires entitlement platform.release_channels
GET/v1/release/packRequires entitlement platform.signed_release_pack
GET/v1/release/parityRequires entitlement platform.self_hosted_release_parity
POST/v1/release/verifyRequires entitlement platform.signed_release_verification

risk 4

MethodPathSummary
GET/v1/risk/portfolioRequires entitlement control_plane.risk_quant
GET/v1/risk/scenariosRequires entitlement control_plane.risk_quant
POST/v1/risk/scenariosRequires entitlement control_plane.risk_quant
DELETE/v1/risk/scenarios/{id}Requires entitlement control_plane.risk_quant

roadmap 1

MethodPathSummary
GET/v1/roadmap§45 public roadmap (free-tier)

scim 11

MethodPathSummary
POST/scim/v2/GroupsRequires entitlement control_plane.shell
GET/scim/v2/Groups/{id}Requires entitlement control_plane.shell
PATCH/scim/v2/Groups/{id}Requires entitlement control_plane.shell
GET/scim/v2/ResourceTypesSCIM 2.0 ResourceTypes (RFC 7644 §4)
GET/scim/v2/SchemasSCIM 2.0 Schemas (RFC 7644 §4)
GET/scim/v2/ServiceProviderConfigSCIM 2.0 ServiceProviderConfig (RFC 7644 §4)
GET/scim/v2/UsersList users (SCIM 2.0; filter=userName eq, pagination)
POST/scim/v2/UsersProvision a user (SCIM 2.0)
DELETE/scim/v2/Users/{id}Deprovision a user (revokes sessions ≤60s)
GET/scim/v2/Users/{id}Requires entitlement control_plane.shell
PATCH/scim/v2/Users/{id}Requires entitlement control_plane.shell

siem 2

MethodPathSummary
GET/v1/siem/alertsRequires entitlement control_plane.siem_hub
GET/v1/siem/overviewRequires entitlement control_plane.siem_hub

sla 2

MethodPathSummary
GET/v1/sla/reportsRequires entitlement platform.sla_reporting
POST/v1/sla/reports/generateRequires entitlement platform.sla_reporting

soar 13

MethodPathSummary
POST/v1/soar/cacao/exportRequires entitlement control_plane.soar
POST/v1/soar/cacao/importRequires entitlement control_plane.soar
GET/v1/soar/casesRequires entitlement control_plane.case_management
POST/v1/soar/casesRequires entitlement control_plane.case_management
GET/v1/soar/cases/{id}Requires entitlement control_plane.case_management
PATCH/v1/soar/cases/{id}Requires entitlement control_plane.case_management
POST/v1/soar/cases/{id}/assignRequires entitlement control_plane.case_management
POST/v1/soar/cases/{id}/escalateRequires entitlement control_plane.case_management
GET/v1/soar/cases/{id}/notesRequires entitlement control_plane.case_management
POST/v1/soar/cases/{id}/notesRequires entitlement control_plane.case_management
POST/v1/soar/cases/{id}/priorityRequires entitlement control_plane.case_management
POST/v1/soar/cases/{id}/transitionRequires entitlement control_plane.case_management
POST/v1/soar/playbooks/{id}/runRequires entitlement control_plane.soar

soc 6

MethodPathSummary
POST/v1/soc/agents/executeRequires entitlement control_plane.agentic_soc
POST/v1/soc/agents/investigateRequires entitlement control_plane.agentic_soc
POST/v1/soc/agents/killswitchRequires entitlement control_plane.agentic_soc
POST/v1/soc/agents/killswitch/resetRequires entitlement control_plane.agentic_soc
GET/v1/soc/agents/modelRequires entitlement control_plane.agentic_soc
GET/v1/soc/agents/scorecardsRequires entitlement control_plane.agentic_soc

sovereignty 3

MethodPathSummary
GET/v1/sovereignty/regionsRequires entitlement platform.sovereign_topology_api
PUT/v1/sovereignty/residencyRequires entitlement platform.sovereign_topology_api
GET/v1/sovereignty/topologyRequires entitlement platform.sovereign_topology_api

sre 1

MethodPathSummary
GET/v1/sre/dashboardsRequires entitlement platform.sre_dashboards

status 6

MethodPathSummary
GET/v1/status§41 public status page (free-tier)
PATCH/v1/status/componentsRequires entitlement control_plane.shell
GET/v1/status/incidents§41 public incident history (free-tier)
POST/v1/status/incidentsRequires entitlement control_plane.shell
POST/v1/status/maintenanceRequires entitlement control_plane.shell
POST/v1/status/subscriptions§41 status subscriptions (free-tier)

suite 9

MethodPathSummary
GET/v1/suite/airgap-bundlesRequires entitlement suite.airgap_bundle_distribution
POST/v1/suite/airgap-bundlesRequires entitlement suite.airgap_bundle_distribution
GET/v1/suite/audit-pipelineRequires entitlement suite.shared_audit_pipeline
GET/v1/suite/licensing-clientRequires entitlement suite.shared_licensing_client
GET/v1/suite/otelRequires entitlement suite.shared_otel_collector
DELETE/v1/suite/routesRequires entitlement suite.cross_suite_routing
GET/v1/suite/routesRequires entitlement suite.cross_suite_routing
PUT/v1/suite/routesRequires entitlement suite.cross_suite_routing
GET/v1/suite/shell-configRequires entitlement suite.admin_shell_ui

telemetry 4

MethodPathSummary
POST/v1/telemetry/evaluateRequires entitlement control_plane.telemetry_fabric
GET/v1/telemetry/routesRequires entitlement control_plane.telemetry_fabric
POST/v1/telemetry/routesRequires entitlement control_plane.telemetry_fabric
DELETE/v1/telemetry/routes/{id}Requires entitlement control_plane.telemetry_fabric

tenants 6

MethodPathSummary
POST/v1/tenantsProvision a tenant
DELETE/v1/tenants/{id}Requires entitlement control_plane.shell
GET/v1/tenants/{id}Get a tenant (RLS-scoped)
POST/v1/tenants/{id}/exportRequires entitlement control_plane.shell
POST/v1/tenants/{id}/resumeRequires entitlement control_plane.shell
POST/v1/tenants/{id}/suspendRequires entitlement control_plane.shell

trust 2

MethodPathSummary
GET/v1/trust/portal§44 public trust portal (free-tier discovery)
GET/v1/trust/portal/privateRequires entitlement platform.trust_portal_automation

ueba 4

MethodPathSummary
GET/v1/ueba/anomaliesRequires entitlement control_plane.ueba
GET/v1/ueba/entitiesRequires entitlement control_plane.ueba
GET/v1/ueba/entities/{entity}Requires entitlement control_plane.ueba
POST/v1/ueba/scanRequires entitlement control_plane.ueba

updates 4

MethodPathSummary
POST/v1/updates/applyRequires entitlement control_plane.shell
GET/v1/updates/checkRequires entitlement control_plane.shell
POST/v1/updates/checkRequires entitlement control_plane.shell
GET/v1/updates/statusRequires entitlement control_plane.shell

webhooks 5

MethodPathSummary
GET/v1/webhooksRequires entitlement control_plane.shell
POST/v1/webhooksRequires entitlement control_plane.shell
GET/v1/webhooks/deliveriesRequires entitlement control_plane.shell
POST/v1/webhooks/deliveries/{id}/replayRequires entitlement control_plane.shell
POST/v1/webhooks/testRequires entitlement control_plane.shell

workloads 86

MethodPathSummary
GET/v1/workloads/adm/clustersRequires entitlement control_plane.app_dependency_map
DELETE/v1/workloads/adm/clusters/{id}Requires entitlement control_plane.app_dependency_map
GET/v1/workloads/adm/clusters/{id}Requires entitlement control_plane.app_dependency_map
PUT/v1/workloads/adm/clusters/{id}Requires entitlement control_plane.app_dependency_map
GET/v1/workloads/adm/dependenciesRequires entitlement control_plane.app_dependency_map
POST/v1/workloads/adm/discoverRequires entitlement control_plane.app_dependency_map
GET/v1/workloads/annotationsRequires entitlement control_plane.inventory_enrichment
POST/v1/workloads/annotationsRequires entitlement control_plane.inventory_enrichment
GET/v1/workloads/cloud/accountsRequires entitlement control_plane.cloud_enforcement
POST/v1/workloads/cloud/accountsRequires entitlement control_plane.cloud_enforcement
DELETE/v1/workloads/cloud/accounts/{id}Requires entitlement control_plane.cloud_enforcement
GET/v1/workloads/cloud/stateRequires entitlement control_plane.cloud_enforcement
POST/v1/workloads/cloud/syncRequires entitlement control_plane.cloud_enforcement
GET/v1/workloads/endpointsRequires entitlement control_plane.endpoint_context
POST/v1/workloads/endpoints/ingestRequires entitlement control_plane.endpoint_context
GET/v1/workloads/endpoints/summaryRequires entitlement control_plane.endpoint_context
DELETE/v1/workloads/endpoints/{id}Requires entitlement control_plane.endpoint_context
POST/v1/workloads/enforcement/applyRequires entitlement control_plane.segmentation_enforcement
POST/v1/workloads/enforcement/compileRequires entitlement control_plane.segmentation_enforcement
POST/v1/workloads/enforcement/rollbackRequires entitlement control_plane.segmentation_enforcement
GET/v1/workloads/enforcement/stateRequires entitlement control_plane.segmentation_enforcement
GET/v1/workloads/enrichment/sourcesRequires entitlement control_plane.inventory_enrichment
POST/v1/workloads/enrichment/sourcesRequires entitlement control_plane.inventory_enrichment
DELETE/v1/workloads/enrichment/sources/{id}Requires entitlement control_plane.inventory_enrichment
POST/v1/workloads/enrichment/sources/{id}/syncRequires entitlement control_plane.inventory_enrichment
GET/v1/workloads/flowsRequires entitlement control_plane.flow_fabric
GET/v1/workloads/flows/collectorRequires entitlement control_plane.flow_fabric
GET/v1/workloads/flows/coverageRequires entitlement control_plane.flow_fabric
GET/v1/workloads/flows/exportersRequires entitlement control_plane.flow_fabric
POST/v1/workloads/flows/exportersRequires entitlement control_plane.flow_fabric
DELETE/v1/workloads/flows/exporters/{id}Requires entitlement control_plane.flow_fabric
POST/v1/workloads/flows/ingestRequires entitlement control_plane.flow_fabric
GET/v1/workloads/flows/topologyRequires entitlement control_plane.flow_fabric
POST/v1/workloads/forensics/evaluateRequires entitlement control_plane.workload_sensor
GET/v1/workloads/forensics/eventsRequires entitlement control_plane.workload_sensor
GET/v1/workloads/forensics/rulesRequires entitlement control_plane.workload_sensor
POST/v1/workloads/forensics/rulesRequires entitlement control_plane.workload_sensor
DELETE/v1/workloads/forensics/rules/{id}Requires entitlement control_plane.workload_sensor
GET/v1/workloads/intent/exportRequires entitlement control_plane.policy_intent_egress
GET/v1/workloads/intent/publicationsRequires entitlement control_plane.policy_intent_egress
POST/v1/workloads/intent/publishRequires entitlement control_plane.policy_intent_egress
GET/v1/workloads/intent/subscribersRequires entitlement control_plane.policy_intent_egress
POST/v1/workloads/intent/subscribersRequires entitlement control_plane.policy_intent_egress
DELETE/v1/workloads/intent/subscribers/{id}Requires entitlement control_plane.policy_intent_egress
GET/v1/workloads/inventoryRequires entitlement control_plane.software_inventory
POST/v1/workloads/inventory/collectRequires entitlement control_plane.software_inventory
POST/v1/workloads/inventory/ingestRequires entitlement control_plane.software_inventory
POST/v1/workloads/k8s/applyRequires entitlement control_plane.container_segmentation
GET/v1/workloads/k8s/clustersRequires entitlement control_plane.container_segmentation
POST/v1/workloads/k8s/clustersRequires entitlement control_plane.container_segmentation
DELETE/v1/workloads/k8s/clusters/{id}Requires entitlement control_plane.container_segmentation
POST/v1/workloads/k8s/compileRequires entitlement control_plane.container_segmentation
GET/v1/workloads/k8s/stateRequires entitlement control_plane.container_segmentation
GET/v1/workloads/meteringRequires entitlement control_plane.shell
POST/v1/workloads/metering/recordRequires entitlement control_plane.shell
POST/v1/workloads/policy/discoverRequires entitlement control_plane.segmentation_policy
GET/v1/workloads/policy/policiesRequires entitlement control_plane.segmentation_policy
DELETE/v1/workloads/policy/policies/{id}Requires entitlement control_plane.segmentation_policy
GET/v1/workloads/policy/policies/{id}Requires entitlement control_plane.segmentation_policy
GET/v1/workloads/policy/policies/{id}/diffRequires entitlement control_plane.segmentation_policy
POST/v1/workloads/policy/policies/{id}/publishRequires entitlement control_plane.segmentation_policy
POST/v1/workloads/policy/policies/{id}/rulesRequires entitlement control_plane.segmentation_policy
POST/v1/workloads/policy/policies/{id}/validateRequires entitlement control_plane.segmentation_policy
DELETE/v1/workloads/policy/rules/{id}Requires entitlement control_plane.segmentation_policy
GET/v1/workloads/policy/violationsRequires entitlement control_plane.segmentation_policy
POST/v1/workloads/policy/violations/{id}/ackRequires entitlement control_plane.segmentation_policy
GET/v1/workloads/processesRequires entitlement control_plane.workload_sensor
POST/v1/workloads/processes/baselineRequires entitlement control_plane.workload_sensor
POST/v1/workloads/processes/collectRequires entitlement control_plane.workload_sensor
POST/v1/workloads/processes/ingestRequires entitlement control_plane.workload_sensor
POST/v1/workloads/processes/verdictsRequires entitlement control_plane.workload_sensor
GET/v1/workloads/reportsRequires entitlement control_plane.workload_score
POST/v1/workloads/risk/evaluateRequires entitlement control_plane.workload_risk
GET/v1/workloads/risk/firesRequires entitlement control_plane.workload_risk
POST/v1/workloads/risk/fires/{id}/executeRequires entitlement control_plane.workload_risk
GET/v1/workloads/risk/triggersRequires entitlement control_plane.workload_risk
POST/v1/workloads/risk/triggersRequires entitlement control_plane.workload_risk
DELETE/v1/workloads/risk/triggers/{id}Requires entitlement control_plane.workload_risk
GET/v1/workloads/scoreRequires entitlement control_plane.workload_score
GET/v1/workloads/score/historyRequires entitlement control_plane.workload_score
POST/v1/workloads/score/snapshotRequires entitlement control_plane.workload_score
GET/v1/workloads/selectRequires entitlement control_plane.inventory_enrichment
POST/v1/workloads/vuln-feedRequires entitlement control_plane.software_inventory
POST/v1/workloads/vuln-feed/pullRequires entitlement control_plane.software_inventory
POST/v1/workloads/vuln-scanRequires entitlement control_plane.software_inventory
GET/v1/workloads/vulnerabilitiesRequires entitlement control_plane.software_inventory

ztp 4

MethodPathSummary
POST/v1/ztp/redeemRequires entitlement control_plane.ztp
GET/v1/ztp/tokensRequires entitlement control_plane.ztp
POST/v1/ztp/tokensRequires entitlement control_plane.ztp
DELETE/v1/ztp/tokens/{id}Requires entitlement control_plane.ztp