{ "categories": [ { "id": "mail", "title": "Mail, calendar and files" }, { "id": "ai", "title": "AI models" }, { "id": "code", "title": "Code and deploy" }, { "id": "productivity", "title": "Productivity and chat" }, { "id": "observability", "title": "Observability" }, { "id": "infrastructure", "title": "Infrastructure and data" }, { "id": "customers", "title": "Payments, CRM and email" }, { "id": "search", "title": "Search, web and media" }, { "id": "clients", "title": "OAuth clients" } ], "templates": [ { "id": "openai", "displayName": "OpenAI API key", "kind": "api-key", "category": "ai", "docsUrl": "https://platform.openai.com/api-keys", "binding": { "hosts": [ "api.openai.com" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/responses", "/v1/responses/*/cancel", "/v1/responses/input_tokens", "/v1/chat/completions", "/v1/completions", "/v1/embeddings", "/v1/moderations", "/v1/images/generations", "/v1/images/edits", "/v1/images/variations", "/v1/audio/speech", "/v1/audio/transcriptions", "/v1/audio/translations", "/v1/files", "/v1/uploads", "/v1/uploads/*/parts", "/v1/uploads/*/complete", "/v1/batches", "/v1/batches/*/cancel", "/v1/conversations", "/v1/conversations/*/items" ], "note": "model calls and the data they use" }, { "action": "deny", "paths": [ "/v1/organization/**" ], "note": "admin API" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key", "pattern": "^sk-" } }, "prefixes": [ "sk-proj-", "sk-" ], "policySummary": { "allowed": [ "reads", "model calls and the data they use" ], "approve": [], "deny": [ "admin API" ], "rest": "approve" } }, { "id": "anthropic", "displayName": "Anthropic API key", "kind": "api-key", "category": "ai", "docsUrl": "https://console.anthropic.com/settings/keys", "binding": { "hosts": [ "api.anthropic.com" ] }, "injection": { "in": "header", "name": "x-api-key", "format": "{key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/messages", "/v1/messages/count_tokens", "/v1/messages/batches", "/v1/messages/batches/*/cancel", "/v1/complete", "/v1/files" ], "note": "model calls and the data they use" }, { "action": "deny", "paths": [ "/v1/organizations/**" ], "note": "admin API" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key", "pattern": "^sk-ant-" } }, "prefixes": [ "sk-ant-api03-", "sk-ant-" ], "policySummary": { "allowed": [ "reads", "model calls and the data they use" ], "approve": [], "deny": [ "admin API" ], "rest": "approve" } }, { "id": "github-pat", "displayName": "GitHub personal access token", "kind": "api-key", "category": "code", "docsUrl": "https://github.com/settings/personal-access-tokens", "binding": { "hosts": [ "api.github.com" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/graphql" ], "body": "graphql-query", "note": "read-only GraphQL queries" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/user/keys/**", "/user/gpg_keys/**", "/user/ssh_signing_keys/**", "/repos/*/*/keys/**", "/repositories/*/keys/**" ], "note": "SSH, signing and deploy keys" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/repos/*/*/hooks/**", "/repositories/*/hooks/**", "/orgs/*/hooks/**", "/organizations/*/hooks/**" ], "note": "webhooks" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/repos/*/*/collaborators/**", "/repositories/*/collaborators/**", "/repos/*/*/invitations/**", "/repositories/*/invitations/**", "/orgs/*/invitations/**", "/organizations/*/invitations/**", "/orgs/*/memberships/**", "/organizations/*/memberships/**", "/orgs/*/teams/*/memberships/**", "/organizations/*/teams/*/memberships/**", "/orgs/*/outside_collaborators/**", "/organizations/*/outside_collaborators/**", "/user/repository_invitations/**" ], "note": "collaborators, invitations and memberships give someone else access" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/repos/*/*/actions/runners/**", "/repositories/*/actions/runners/**", "/orgs/*/actions/runners/**", "/organizations/*/actions/runners/**", "/orgs/*/actions/runner-groups/**", "/organizations/*/actions/runner-groups/**", "/enterprises/*/actions/runners/**" ], "note": "self-hosted runners and their tokens receive jobs and their secrets" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/repos/*/*/transfer", "/repositories/*/transfer" ], "note": "transfers the repository away" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/user/emails/**", "/user/email/**" ], "note": "account email addresses reset the password" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/applications/**", "/authorizations/**" ], "note": "OAuth tokens and grants" }, { "action": "approve", "paths": [ "/graphql" ], "body": "graphql-mutation", "note": "GraphQL requests that are not plainly a query" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Token", "pattern": "^(github_pat_|ghp_)" } }, "prefixes": [ "github_pat_", "ghp_" ], "policySummary": { "allowed": [ "reads", "read-only GraphQL queries" ], "approve": [ "GraphQL requests that are not plainly a query" ], "deny": [ "SSH, signing and deploy keys", "webhooks", "collaborators, invitations and memberships give someone else access", "self-hosted runners and their tokens receive jobs and their secrets", "transfers the repository away", "account email addresses reset the password", "OAuth tokens and grants" ], "rest": "approve" } }, { "id": "cloudflare-api-token", "displayName": "Cloudflare API token", "kind": "api-key", "category": "infrastructure", "docsUrl": "https://dash.cloudflare.com/profile/api-tokens", "binding": { "hosts": [ "api.cloudflare.com" ], "paths": [ "/client/v4/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/client/v4/graphql" ], "body": "graphql-query", "note": "GraphQL Analytics queries" }, { "action": "approve", "methods": [ "DELETE" ], "note": "deletes" }, { "action": "deny", "paths": [ "/client/v4/user/tokens/**", "/client/v4/accounts/*/tokens/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "minting tokens" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API token" } }, "policySummary": { "allowed": [ "reads", "GraphQL Analytics queries" ], "approve": [ "deletes" ], "deny": [ "minting tokens" ], "rest": "approve" } }, { "id": "linear", "displayName": "Linear API key", "kind": "api-key", "category": "productivity", "docsUrl": "https://linear.app/settings/account/security", "binding": { "hosts": [ "api.linear.app" ], "paths": [ "/graphql" ], "methods": [ "POST" ] }, "injection": { "in": "header", "name": "Authorization", "format": "{key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "POST" ], "paths": [ "/graphql" ], "body": "graphql-query", "note": "read-only GraphQL queries" }, { "action": "approve", "paths": [ "/graphql" ], "body": "graphql-mutation", "note": "GraphQL requests that are not plainly a query" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key", "pattern": "^lin_api_" } }, "prefixes": [ "lin_api_" ], "policySummary": { "allowed": [ "read-only GraphQL queries" ], "approve": [ "GraphQL requests that are not plainly a query" ], "deny": [], "rest": "approve" } }, { "id": "stripe", "displayName": "Stripe secret key", "kind": "api-key", "category": "customers", "docsUrl": "https://dashboard.stripe.com/apikeys", "binding": { "hosts": [ "api.stripe.com" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/products", "/v1/products/*", "/v1/prices", "/v1/prices/*" ], "note": "catalogue records" }, { "action": "approve", "methods": [ "POST", "DELETE" ], "paths": [ "/v1/payouts/**", "/v1/refunds/**", "/v1/transfers/**" ], "note": "moves money" }, { "action": "deny", "paths": [ "/v1/webhook_endpoints/**", "/v1/webhook_endpoints" ], "methods": [ "POST", "DELETE" ], "note": "webhooks" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Secret key", "pattern": "^(sk|rk)_(test|live)_" } }, "prefixes": [ "sk_live_", "sk_test_", "rk_live_", "rk_test_" ], "policySummary": { "allowed": [ "reads", "catalogue records" ], "approve": [ "moves money" ], "deny": [ "webhooks" ], "rest": "approve" } }, { "id": "slack-bot", "displayName": "Slack bot token", "kind": "api-key", "category": "productivity", "docsUrl": "https://api.slack.com/apps", "binding": { "hosts": [ "slack.com" ], "paths": [ "/api/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "paths": [ "/api/auth.test", "/api/bots.info", "/api/chat.getPermalink", "/api/conversations.history", "/api/conversations.info", "/api/conversations.list", "/api/conversations.members", "/api/conversations.replies", "/api/emoji.list", "/api/files.info", "/api/files.list", "/api/pins.list", "/api/reactions.get", "/api/reactions.list", "/api/team.info", "/api/usergroups.list", "/api/usergroups.users.list", "/api/users.conversations", "/api/users.getPresence", "/api/users.info", "/api/users.list", "/api/users.lookupByEmail", "/api/users.profile.get" ], "note": "read methods" }, { "action": "allow", "paths": [ "/api/reactions.add" ], "note": "adds an emoji reaction" }, { "action": "deny", "paths": [ "/api/files.getUploadURLExternal", "/api/files.completeUploadExternal", "/api/files.upload", "/api/files.remote.add", "/api/files.remote.info", "/api/files.remote.list", "/api/files.remote.remove", "/api/files.remote.share", "/api/files.remote.update" ], "note": "uploads bypass the approval card; ask the human to upload" }, { "action": "approve", "paths": [ "/api/chat.postMessage", "/api/chat.postEphemeral", "/api/chat.scheduleMessage", "/api/chat.meMessage", "/api/chat.update", "/api/chat.delete", "/api/conversations.invite" ], "note": "posts, shares or invites as the bot" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Bot token", "pattern": "^xoxb-" } }, "prefixes": [ "xoxb-" ], "policySummary": { "allowed": [ "read methods", "adds an emoji reaction" ], "approve": [ "posts, shares or invites as the bot" ], "deny": [ "uploads bypass the approval card; ask the human to upload" ], "rest": "approve" } }, { "id": "google-gemini", "displayName": "Google Gemini API key", "kind": "api-key", "category": "ai", "docsUrl": "https://aistudio.google.com/apikey", "binding": { "hosts": [ "generativelanguage.googleapis.com" ], "paths": [ "/v1beta/**", "/v1/**", "/upload/v1beta/**" ] }, "injection": { "in": "header", "name": "x-goog-api-key", "format": "{key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1beta/models/*", "/v1/models/*", "/v1beta/openai/chat/completions", "/v1beta/openai/embeddings", "/v1beta/openai/images/generations", "/v1beta/files", "/upload/v1beta/files", "/v1beta/cachedContents" ], "note": "model calls and the data they use" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1beta/tunedModels/*/permissions/**", "/v1beta/corpora/*/permissions/**" ], "note": "shares a tuned model or a corpus with someone else" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key", "pattern": "^AIza" } }, "prefixes": [ "AIza" ], "policySummary": { "allowed": [ "reads", "model calls and the data they use" ], "approve": [], "deny": [ "shares a tuned model or a corpus with someone else" ], "rest": "approve" } }, { "id": "mistral", "displayName": "Mistral API key", "kind": "api-key", "category": "ai", "docsUrl": "https://console.mistral.ai/api-keys", "binding": { "hosts": [ "api.mistral.ai" ], "paths": [ "/v1/**", "/v2/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/chat/completions", "/v1/fim/completions", "/v1/agents/completions", "/v1/embeddings", "/v1/moderations", "/v1/chat/moderations", "/v1/classifications", "/v1/chat/classifications", "/v1/ocr", "/v1/audio/speech", "/v1/audio/transcriptions", "/v1/files", "/v1/batch/jobs", "/v1/batch/jobs/*/cancel", "/v1/conversations", "/v1/conversations/*", "/v1/conversations/*/restart" ], "note": "model calls and the data they use" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/service-accounts/**" ], "note": "service accounts and their roles" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/libraries/*/share" ], "note": "shares a library with someone else" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "reads", "model calls and the data they use" ], "approve": [], "deny": [ "service accounts and their roles", "shares a library with someone else" ], "rest": "approve" } }, { "id": "groq", "displayName": "Groq API key", "kind": "api-key", "category": "ai", "docsUrl": "https://console.groq.com/keys", "binding": { "hosts": [ "api.groq.com" ], "paths": [ "/openai/v1/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/openai/v1/chat/completions", "/openai/v1/responses", "/openai/v1/audio/speech", "/openai/v1/audio/transcriptions", "/openai/v1/audio/translations", "/openai/v1/reranking", "/openai/v1/files", "/openai/v1/batches", "/openai/v1/batches/*/cancel" ], "note": "model calls and the data they use" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key", "pattern": "^gsk_" } }, "prefixes": [ "gsk_" ], "policySummary": { "allowed": [ "reads", "model calls and the data they use" ], "approve": [], "deny": [], "rest": "approve" } }, { "id": "openrouter", "displayName": "OpenRouter API key", "kind": "api-key", "category": "ai", "docsUrl": "https://openrouter.ai/settings/keys", "binding": { "hosts": [ "openrouter.ai" ], "paths": [ "/api/v1/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/api/v1/chat/completions", "/api/v1/completions", "/api/v1/responses", "/api/v1/messages", "/api/v1/embeddings", "/api/v1/rerank", "/api/v1/images", "/api/v1/audio/speech", "/api/v1/audio/transcriptions" ], "note": "model calls and the data they use" }, { "action": "approve", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v1/credits/**", "/api/v1/workspaces/*/budgets/**" ], "note": "buys credits or changes a budget" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v1/keys/**", "/api/v1/auth/keys/**" ], "note": "mints or revokes API keys" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v1/byok/**" ], "note": "provider keys" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v1/observability/destinations/**" ], "note": "observability destinations copy every request elsewhere" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v1/workspaces/*/members/**", "/api/v1/scim/**" ], "note": "members and directory sync give someone else access" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v1/vault/**" ], "note": "stored secrets" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key", "pattern": "^sk-or-" } }, "prefixes": [ "sk-or-v1-" ], "policySummary": { "allowed": [ "reads", "model calls and the data they use" ], "approve": [ "buys credits or changes a budget" ], "deny": [ "mints or revokes API keys", "provider keys", "observability destinations copy every request elsewhere", "members and directory sync give someone else access", "stored secrets" ], "rest": "approve" } }, { "id": "together", "displayName": "Together AI API key", "kind": "api-key", "category": "ai", "docsUrl": "https://api.together.ai/settings/api-keys", "binding": { "hosts": [ "api.together.xyz" ], "paths": [ "/v1/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/chat/completions", "/v1/completions", "/v1/embeddings", "/v1/images/generations", "/v1/audio/speech", "/v1/audio/transcriptions", "/v1/audio/translations", "/v1/rerank" ], "note": "model calls and the data they use" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "reads", "model calls and the data they use" ], "approve": [], "deny": [], "rest": "approve" } }, { "id": "ollama-cloud", "displayName": "Ollama Cloud API key", "kind": "api-key", "category": "ai", "docsUrl": "https://ollama.com/settings/keys", "binding": { "hosts": [ "ollama.com" ], "paths": [ "/api/**", "/v1/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/api/chat", "/api/generate", "/api/embed", "/api/embeddings", "/api/show", "/v1/chat/completions", "/v1/completions", "/v1/embeddings", "/v1/responses", "/v1/messages", "/v1/messages/count_tokens" ], "note": "model calls and the data they use" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/api/web_search" ], "note": "web searches" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "reads", "model calls and the data they use", "web searches" ], "approve": [], "deny": [], "rest": "approve" } }, { "id": "snyk", "displayName": "Snyk API token", "kind": "api-key", "category": "code", "docsUrl": "https://app.snyk.io/account", "binding": { "hosts": [ "api.snyk.io", "api.us.snyk.io", "api.eu.snyk.io", "api.au.snyk.io" ], "paths": [ "/rest/**", "/v1/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "token {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/test/**", "/rest/orgs/*/packages/issues" ], "note": "tests dependencies for known issues" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/rest/orgs/*/invites/**", "/rest/orgs/*/memberships/**", "/rest/groups/*/memberships/**", "/rest/groups/*/users/**", "/v1/org/*/invite", "/v1/org/*/members/**" ], "note": "invitations and memberships give someone else access" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/rest/orgs/*/service_accounts/**", "/rest/groups/*/service_accounts/**" ], "note": "service accounts and their secrets" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/rest/orgs/*/apps/**", "/rest/groups/*/apps/**" ], "note": "Snyk Apps and their client secrets" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/org/*/webhooks/**" ], "note": "webhooks" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API token" } }, "setup": { "title": "In Snyk", "steps": [ { "title": "Open your account settings", "body": "Sign in to Snyk in the region your organisation lives in. A token works only in its own region.", "docs": true }, { "title": "Copy a token", "body": "Under Auth Token, show and copy the token. For a shared or long-lived use, an organisation service account token is better: Settings, then Service accounts.", "field": "key" } ] }, "policySummary": { "allowed": [ "reads", "tests dependencies for known issues" ], "approve": [], "deny": [ "invitations and memberships give someone else access", "service accounts and their secrets", "Snyk Apps and their client secrets", "webhooks" ], "rest": "approve" } }, { "id": "vercel", "displayName": "Vercel access token", "kind": "api-key", "category": "code", "docsUrl": "https://vercel.com/account/settings/tokens", "binding": { "hosts": [ "api.vercel.com" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "approve", "paths": [ "/*/env/**", "/*/projects/*/env/**" ], "note": "environment variables, whose values are secrets" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/*/user/tokens/**" ], "note": "mints or revokes access tokens" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/*/teams/*/members/**", "/*/teams/*/invites/**", "/*/teams/*/request", "/*/projects/*/members/**", "/*/access-groups/**" ], "note": "members, invitations and access groups give someone else access" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/*/webhooks/**" ], "note": "webhooks" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/*/drains/**", "/*/log-drains/**", "/*/integrations/log-drains/**" ], "note": "drains send logs and traces elsewhere" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/projects/*/transfer-request", "/projects/transfer-request/**", "/*/projects/*/transfer-request" ], "note": "transfers a project to another account" }, { "action": "deny", "methods": [ "DELETE" ], "paths": [ "/*/projects/*", "/*/teams/*", "/*/user" ], "note": "deletes a project, a team or the account" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/*/billing/**" ], "note": "buys credits" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Token" } }, "setup": { "title": "In Vercel", "steps": [ { "title": "Open the tokens page", "body": "Account settings, then Tokens.", "docs": true }, { "title": "Create a token for one team", "body": "Set the scope to the team the agent works in, not your whole account, and pick an expiry.", "field": "key" } ] }, "policySummary": { "allowed": [ "reads" ], "approve": [ "environment variables, whose values are secrets" ], "deny": [ "mints or revokes access tokens", "members, invitations and access groups give someone else access", "webhooks", "drains send logs and traces elsewhere", "transfers a project to another account", "deletes a project, a team or the account", "buys credits" ], "rest": "approve" } }, { "id": "npm", "displayName": "npm access token", "kind": "api-key", "category": "code", "docsUrl": "https://docs.npmjs.com/creating-and-viewing-access-tokens", "binding": { "hosts": [ "registry.npmjs.org" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "approve", "methods": [ "PUT", "DELETE" ], "paths": [ "/*", "/*/-rev/**" ], "note": "publishes, deprecates or unpublishes a package" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/-/npm/v1/tokens/**" ], "note": "mints or revokes tokens" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/-/user/**", "/-/v1/login/**", "/-/npm/v1/user/**" ], "note": "signs in, adds a user or changes account settings" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/-/package/*/access", "/-/package/*/collaborators/**", "/-/package/*/trust/**", "/-/team/**", "/-/org/**" ], "note": "access, owners, teams, organisation members and trusted publishers decide who may publish" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/-/npm/v1/hooks/**" ], "note": "hooks" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Access token", "pattern": "^npm_" } }, "prefixes": [ "npm_" ], "setup": { "title": "On npmjs.com", "steps": [ { "title": "Open your access tokens", "body": "On npmjs.com, your avatar, then Access tokens, then Generate new token. The guide explains each kind.", "docs": true }, { "title": "Create a granular token", "body": "Choose Granular access token, give it read-only or read and write access to only the packages it needs, and set an expiry.", "warn": "Scoped packages (@scope/name) cannot be reached through the vault yet: their names contain an encoded slash, which the vault refuses.", "field": "key" } ] }, "policySummary": { "allowed": [ "reads" ], "approve": [ "publishes, deprecates or unpublishes a package" ], "deny": [ "mints or revokes tokens", "signs in, adds a user or changes account settings", "access, owners, teams, organisation members and trusted publishers decide who may publish", "hooks" ], "rest": "approve" } }, { "id": "notion", "displayName": "Notion integration token", "kind": "api-key", "category": "productivity", "docsUrl": "https://www.notion.so/profile/integrations", "binding": { "hosts": [ "api.notion.com" ], "paths": [ "/v1/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/search", "/v1/data_sources/*/query", "/v1/databases/*/query", "/v1/views/*/queries", "/v1/blocks/meeting_notes/query" ], "note": "searches and queries" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/oauth/**" ], "note": "OAuth tokens" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Internal integration secret", "pattern": "^(ntn_|secret_)" } }, "prefixes": [ "ntn_", "secret_" ], "setup": { "title": "In Notion", "steps": [ { "title": "Create an internal integration", "body": "Open the integrations page, choose New integration, pick the workspace and the type Internal.", "docs": true }, { "title": "Choose its capabilities", "body": "Tick Read content, and Update or Insert content only if the agent is to write. Copy the Internal integration secret.", "field": "key" }, { "title": "Share pages with it", "body": "The integration sees only the pages and databases you connect it to: on each page, the menu, then Connections, then add the integration.", "warn": "Every request to Notion must also carry a Notion-Version header. The vault adds only the secret, so the agent sends that header itself." } ] }, "policySummary": { "allowed": [ "reads", "searches and queries" ], "approve": [], "deny": [ "OAuth tokens" ], "rest": "approve" } }, { "id": "gitbook", "displayName": "GitBook API token", "kind": "api-key", "category": "productivity", "docsUrl": "https://app.gitbook.com/account/developer", "binding": { "hosts": [ "api.gitbook.com" ], "paths": [ "/v1/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/orgs/*/sites/*/search", "/v1/orgs/*/sites/*/ask", "/v1/orgs/*/ask" ], "note": "searches and questions" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/orgs/*/members/**", "/v1/orgs/*/invites/**", "/v1/orgs/*/link-invites/**", "/v1/orgs/*/teams/*/members/**", "/v1/spaces/*/permissions/**", "/v1/collections/*/permissions/**", "/v1/orgs/*/sites/*/permissions/**" ], "note": "members, invitations and permissions give someone else access" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/orgs/*/sites/*/share-links/**" ], "note": "share links open a site to anyone with the link" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/integrations/*/installations/*/tokens/**" ], "note": "mints integration tokens" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/collections/*/transfer" ], "note": "transfers a collection away" }, { "action": "deny", "methods": [ "DELETE" ], "paths": [ "/v1/spaces/*" ], "note": "deletes a space" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API token" } }, "policySummary": { "allowed": [ "reads", "searches and questions" ], "approve": [], "deny": [ "members, invitations and permissions give someone else access", "share links open a site to anyone with the link", "mints integration tokens", "transfers a collection away", "deletes a space" ], "rest": "approve" } }, { "id": "fathom", "displayName": "Fathom API key", "kind": "api-key", "category": "productivity", "docsUrl": "https://fathom.video/customize#api-access-header", "binding": { "hosts": [ "api.fathom.ai" ], "paths": [ "/external/v1/**" ] }, "injection": { "in": "header", "name": "X-Api-Key", "format": "{key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "approve", "paths": [ "/external/v1/recordings/*/summary", "/external/v1/recordings/*/transcript" ], "note": "a summary or transcript, which can be sent on to any URL; read it from the meetings list" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/external/v1/webhooks/**" ], "note": "webhooks send every meeting elsewhere" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "reads" ], "approve": [ "a summary or transcript, which can be sent on to any URL; read it from the meetings list" ], "deny": [ "webhooks send every meeting elsewhere" ], "rest": "approve" } }, { "id": "sentry", "displayName": "Sentry auth token", "kind": "api-key", "category": "observability", "docsUrl": "https://sentry.io/settings/account/api/auth-tokens/", "binding": { "hosts": [ "sentry.io", "us.sentry.io", "de.sentry.io" ], "paths": [ "/api/0/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/0/organizations/*/members/**", "/api/0/organizations/*/scim/**", "/api/0/organizations/*/invite-requests/**" ], "note": "members and invitations give someone else access" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/0/projects/*/*/hooks/**" ], "note": "service hooks send events elsewhere" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/0/organizations/*/forwarding/**" ], "note": "data forwarding sends every event elsewhere" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/0/api-tokens/**", "/api/0/organizations/*/org-auth-tokens/**" ], "note": "mints or revokes auth tokens" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/0/sentry-apps/**", "/api/0/organizations/*/sentry-apps/**" ], "note": "custom integrations receive webhooks and tokens" }, { "action": "deny", "methods": [ "DELETE" ], "paths": [ "/api/0/organizations/*", "/api/0/projects/*/*" ], "note": "deletes an organisation or a project" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Auth token", "pattern": "^sntry[us]_" } }, "prefixes": [ "sntryu_", "sntrys_" ], "setup": { "title": "In Sentry", "steps": [ { "title": "Open your auth tokens", "body": "User settings, then Personal tokens. An organisation token (Settings, then Auth tokens) suits CI and releases only.", "docs": true }, { "title": "Create a token with read scopes", "body": "Tick the read scopes the agent needs, for example project:read, org:read and event:read, and add write scopes only if it is to change issues.", "field": "key" } ] }, "policySummary": { "allowed": [ "reads" ], "approve": [], "deny": [ "members and invitations give someone else access", "service hooks send events elsewhere", "data forwarding sends every event elsewhere", "mints or revokes auth tokens", "custom integrations receive webhooks and tokens", "deletes an organisation or a project" ], "rest": "approve" } }, { "id": "posthog", "displayName": "PostHog personal API key", "kind": "api-key", "category": "observability", "docsUrl": "https://us.posthog.com/settings/user-api-keys", "binding": { "hosts": [ "us.posthog.com", "eu.posthog.com" ], "paths": [ "/api/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/api/projects/*/query", "/api/projects/*/query/*", "/api/projects/*/logs/query", "/api/projects/*/metrics/query", "/api/projects/*/tracing/spans/query", "/api/projects/*/error_tracking/query/**" ], "note": "HogQL and other queries" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/organizations/*/invites/**", "/api/organizations/*/members/**", "/api/organizations/*/roles/**" ], "note": "invitations, members and roles give someone else access" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/personal_api_keys/**", "/api/users/*/personal_api_keys/**" ], "note": "mints or revokes personal API keys" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/projects/*/hog_functions/**", "/api/projects/*/batch_exports/**", "/api/environments/*/hog_functions/**", "/api/environments/*/batch_exports/**" ], "note": "destinations and batch exports send events elsewhere" }, { "action": "deny", "methods": [ "DELETE" ], "paths": [ "/api/projects/*", "/api/environments/*", "/api/organizations/*" ], "note": "deletes a project or an organisation" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Personal API key", "pattern": "^phx_" } }, "prefixes": [ "phx_" ], "setup": { "title": "In PostHog", "steps": [ { "title": "Open your personal API keys", "body": "In the cloud your organisation uses: us.posthog.com or eu.posthog.com, then Settings, then Personal API keys. The link opens the US cloud.", "docs": true }, { "title": "Create a key with read scopes", "body": "Choose the organisation or projects it may reach, and tick read scopes only, for example Query read and Insight read.", "field": "key" } ] }, "policySummary": { "allowed": [ "reads", "HogQL and other queries" ], "approve": [], "deny": [ "invitations, members and roles give someone else access", "mints or revokes personal API keys", "destinations and batch exports send events elsewhere", "deletes a project or an organisation" ], "rest": "approve" } }, { "id": "betterstack-uptime", "displayName": "Better Stack Uptime API token", "kind": "api-key", "category": "observability", "docsUrl": "https://betterstack.com/docs/uptime/api/getting-started-with-uptime-api/", "binding": { "hosts": [ "uptime.betterstack.com" ], "paths": [ "/api/v2/**", "/api/v3/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/api/v2/incidents", "/api/v3/incidents" ], "note": "opens an incident, which pages whoever is on call" }, { "action": "approve", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v2/status-pages/*/status-reports/**" ], "note": "posts on a public status page" }, { "action": "approve", "methods": [ "GET", "HEAD" ], "paths": [ "/api/v2/heartbeats/**", "/api/v3/heartbeats/**", "/api/v2/heartbeat-groups/*/*/**", "/api/v3/heartbeat-groups/*/*/**" ], "note": "heartbeats carry their URL, which lets anyone holding it report a job as healthy or failed" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API token" } }, "setup": { "title": "In Better Stack", "steps": [ { "title": "Find the API tokens", "body": "In Better Stack, open Settings, then API tokens, in the team the agent works in. The guide explains where.", "docs": true }, { "title": "Copy a team token", "body": "Create a token of type Uptime API and copy it. Logs and Telemetry tokens are different and do not work here.", "field": "key" } ] }, "policySummary": { "allowed": [ "reads" ], "approve": [ "opens an incident, which pages whoever is on call", "posts on a public status page", "heartbeats carry their URL, which lets anyone holding it report a job as healthy or failed" ], "deny": [], "rest": "approve" } }, { "id": "hetzner-cloud", "displayName": "Hetzner Cloud API token", "kind": "api-key", "category": "infrastructure", "docsUrl": "https://console.hetzner.cloud/projects", "binding": { "hosts": [ "api.hetzner.cloud" ], "paths": [ "/v1/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/v1/servers", "/v1/volumes", "/v1/load_balancers", "/v1/primary_ips", "/v1/floating_ips", "/v1/servers/*/actions/change_type" ], "note": "creates or resizes something that is billed" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/v1/servers/*/actions/reset_password", "/v1/servers/*/actions/enable_rescue", "/v1/servers/*/actions/rebuild", "/v1/servers/*/actions/request_console" ], "note": "hands out root access to a server" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API token" } }, "setup": { "title": "In the Hetzner Cloud console", "steps": [ { "title": "Open the project", "body": "A token belongs to one project: pick it in the console.", "docs": true }, { "title": "Create a token", "body": "Security, then API tokens, then Generate API token. Choose Read unless the agent is to change servers.", "field": "key" } ] }, "policySummary": { "allowed": [ "reads" ], "approve": [ "creates or resizes something that is billed", "hands out root access to a server" ], "deny": [], "rest": "approve" } }, { "id": "scaleway", "displayName": "Scaleway API key", "kind": "api-key", "category": "infrastructure", "docsUrl": "https://console.scaleway.com/iam/api-keys", "binding": { "hosts": [ "api.scaleway.com" ] }, "injection": { "in": "header", "name": "X-Auth-Token", "format": "{key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "approve", "paths": [ "/secret-manager/*/regions/*/secrets/*/versions/*/access", "/secret-manager/*/regions/*/secrets-by-path/versions/*/access" ], "note": "reads a stored secret's value" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/instance/*/zones/*/servers", "/baremetal/*/zones/*/servers", "/k8s/*/regions/*/clusters", "/rdb/*/regions/*/instances" ], "note": "creates something that is billed" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/iam/**" ], "note": "IAM: API keys, users, applications, groups, policies and SSH keys" }, { "action": "deny", "methods": [ "DELETE" ], "paths": [ "/account/*/projects/*" ], "note": "deletes a project" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Secret key", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" } }, "setup": { "title": "In the Scaleway console", "steps": [ { "title": "Open API keys", "body": "IAM, then API keys. Create the key for an IAM application with only the permission sets the agent needs, not for your own user.", "docs": true }, { "title": "Copy the secret key", "body": "Scaleway shows the secret key once. The access key (SCW...) is not needed.", "field": "key" } ] }, "policySummary": { "allowed": [ "reads" ], "approve": [ "reads a stored secret's value", "creates something that is billed" ], "deny": [ "IAM: API keys, users, applications, groups, policies and SSH keys", "deletes a project" ], "rest": "approve" } }, { "id": "neon", "displayName": "Neon API key", "kind": "api-key", "category": "infrastructure", "docsUrl": "https://console.neon.tech/app/settings/api-keys", "binding": { "hosts": [ "console.neon.tech" ], "paths": [ "/api/v2/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/api/v2/projects/*/branches/*/logs/query" ], "note": "queries branch logs" }, { "action": "approve", "paths": [ "/api/v2/projects/*/connection_uri", "/api/v2/projects/*/branches/*/roles/*/reveal_password", "/api/v2/projects/*/branches/*/roles/*/reset_password", "/api/v2/projects/*/branches/*/realtime/secret", "/api/v2/projects/*/branches/*/credentials/*/reveal" ], "note": "a database password, connection string or other secret" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v2/api_keys/**", "/api/v2/organizations/*/api_keys/**" ], "note": "mints or revokes API keys" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v2/projects/*/permissions/**", "/api/v2/projects/*/members/**", "/api/v2/organizations/*/invitations/**", "/api/v2/organizations/*/members/**" ], "note": "access, members and invitations give someone else access" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v2/projects/*/transfer_requests/**", "/api/v2/organizations/*/projects/transfer", "/api/v2/users/me/projects/transfer" ], "note": "transfers projects to another account" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v2/projects/*/jwks/**" ], "note": "lets an outside identity provider sign in to the database" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api/v2/organizations/*/billing/**" ], "note": "billing and spending limits" }, { "action": "deny", "methods": [ "DELETE" ], "paths": [ "/api/v2/projects/*" ], "note": "deletes a project and every branch in it" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "setup": { "title": "In the Neon console", "steps": [ { "title": "Open API keys", "body": "Organisation settings, then API keys, for a key scoped to one organisation or project; Account settings for a personal key.", "docs": true }, { "title": "Create a project-scoped key", "body": "Where Neon offers it, scope the key to the one project the agent works on.", "field": "key" } ] }, "policySummary": { "allowed": [ "reads", "queries branch logs" ], "approve": [ "a database password, connection string or other secret" ], "deny": [ "mints or revokes API keys", "access, members and invitations give someone else access", "transfers projects to another account", "lets an outside identity provider sign in to the database", "billing and spending limits", "deletes a project and every branch in it" ], "rest": "approve" } }, { "id": "hubspot-private-app", "displayName": "HubSpot private app token", "kind": "api-key", "category": "customers", "docsUrl": "https://developers.hubspot.com/docs/apps/legacy-apps/private-apps/overview", "binding": { "hosts": [ "api.hubapi.com" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/crm/v3/objects/*/search", "/crm/v3/objects/*/batch/read", "/crm/objects/*/*/search", "/crm/objects/*/*/batch/read" ], "note": "CRM searches and batch reads" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/marketing/**/send", "/marketing/**/single-send", "/conversations/*/conversations/threads/*/messages", "/automation/**/enrollments" ], "note": "sends email or a message, or enrols a contact in a sequence" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/settings/*/users/**", "/settings/users/**" ], "note": "adds, changes or removes users" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/webhooks/**", "/app-webhooks/**", "/webhooks-journal/**" ], "note": "webhooks" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/marketing/*/transactional/smtp-tokens/**" ], "note": "mints SMTP tokens" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/oauth/**" ], "note": "OAuth tokens" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Access token", "pattern": "^pat-" } }, "prefixes": [ "pat-na1-", "pat-eu1-" ], "setup": { "title": "In HubSpot", "steps": [ { "title": "Create a private app", "body": "In HubSpot, Settings, then Integrations, then Private apps (Legacy apps in newer portals), then Create. The guide walks through it.", "docs": true }, { "title": "Tick only the scopes it needs", "body": "On Scopes, tick the read scopes for the objects the agent reads, for example crm.objects.contacts.read, and write scopes only where it is to change records.", "field": "key" } ] }, "policySummary": { "allowed": [ "reads", "CRM searches and batch reads" ], "approve": [ "sends email or a message, or enrols a contact in a sequence" ], "deny": [ "adds, changes or removes users", "webhooks", "mints SMTP tokens", "OAuth tokens" ], "rest": "approve" } }, { "id": "intercom", "displayName": "Intercom access token", "kind": "api-key", "category": "customers", "docsUrl": "https://app.intercom.com/a/apps/_/developer-hub", "binding": { "hosts": [ "api.intercom.io", "api.eu.intercom.io", "api.au.intercom.io" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/contacts/search", "/conversations/search", "/tickets/search", "/companies/list" ], "note": "searches" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/conversations/*/reply", "/tickets/*/reply", "/messages", "/conversations", "/news/news_items", "/phone_call_redirects" ], "note": "messages a customer" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Access token" } }, "policySummary": { "allowed": [ "reads", "searches" ], "approve": [ "messages a customer" ], "deny": [], "rest": "approve" } }, { "id": "resend", "displayName": "Resend API key", "kind": "api-key", "category": "customers", "docsUrl": "https://resend.com/api-keys", "binding": { "hosts": [ "api.resend.com" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/emails", "/emails/batch", "/broadcasts/*/send" ], "note": "sends email" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/api-keys/**" ], "note": "mints or revokes API keys" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/webhooks/**" ], "note": "webhooks" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/oauth/**" ], "note": "OAuth grants" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key", "pattern": "^re_" } }, "prefixes": [ "re_" ], "policySummary": { "allowed": [ "reads" ], "approve": [ "sends email" ], "deny": [ "mints or revokes API keys", "webhooks", "OAuth grants" ], "rest": "approve" } }, { "id": "postmark-server", "displayName": "Postmark server token", "kind": "api-key", "category": "customers", "docsUrl": "https://account.postmarkapp.com/servers", "binding": { "hosts": [ "api.postmarkapp.com" ] }, "injection": { "in": "header", "name": "X-Postmark-Server-Token", "format": "{key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "approve", "methods": [ "GET", "HEAD" ], "paths": [ "/server" ], "note": "the server's details, which include its API tokens" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/email", "/email/batch", "/email/withTemplate", "/email/batchWithTemplates" ], "note": "sends email" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/webhooks/**" ], "note": "webhooks" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/server" ], "note": "server settings, including where inbound mail is posted" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "Server API token" } }, "policySummary": { "allowed": [ "reads" ], "approve": [ "the server's details, which include its API tokens", "sends email" ], "deny": [ "webhooks", "server settings, including where inbound mail is posted" ], "rest": "approve" } }, { "id": "loops", "displayName": "Loops API key", "kind": "api-key", "category": "customers", "docsUrl": "https://app.loops.so/settings?page=api", "binding": { "hosts": [ "app.loops.so" ], "paths": [ "/api/v1/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/api/v1/transactional", "/api/v1/events/send", "/api/v1/email-messages/*/preview" ], "note": "sends email, or an event that can send email" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "reads" ], "approve": [ "sends email, or an event that can send email" ], "deny": [], "rest": "approve" } }, { "id": "brave-search", "displayName": "Brave Search API key", "kind": "api-key", "category": "search", "docsUrl": "https://api-dashboard.search.brave.com/app/keys", "binding": { "hosts": [ "api.search.brave.com" ], "paths": [ "/res/v1/**" ] }, "injection": { "in": "header", "name": "X-Subscription-Token", "format": "{key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "searches" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "searches" ], "approve": [], "deny": [], "rest": "approve" } }, { "id": "serpapi", "displayName": "SerpApi API key", "kind": "api-key", "category": "search", "docsUrl": "https://serpapi.com/manage-api-key", "binding": { "hosts": [ "serpapi.com" ], "paths": [ "/search", "/search.json", "/searches/**", "/account", "/account.json", "/locations.json" ] }, "injection": { "in": "query", "name": "api_key", "field": "key" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "searches" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "searches" ], "approve": [], "deny": [], "rest": "approve" } }, { "id": "semrush", "displayName": "Semrush API key", "kind": "api-key", "category": "search", "docsUrl": "https://www.semrush.com/accounts/subscription-info/api-units", "binding": { "hosts": [ "api.semrush.com" ] }, "injection": { "in": "query", "name": "key", "field": "key" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reports, which spend API units" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "reports, which spend API units" ], "approve": [], "deny": [], "rest": "approve" } }, { "id": "firecrawl", "displayName": "Firecrawl API key", "kind": "api-key", "category": "search", "docsUrl": "https://www.firecrawl.dev/app/api-keys", "binding": { "hosts": [ "api.firecrawl.dev" ], "paths": [ "/v1/**", "/v2/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/scrape", "/v2/scrape", "/v1/search", "/v2/search", "/v1/map", "/v2/map", "/v2/parse" ], "note": "scrapes, searches and maps public pages" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key", "pattern": "^fc-" } }, "prefixes": [ "fc-" ], "policySummary": { "allowed": [ "reads", "scrapes, searches and maps public pages" ], "approve": [], "deny": [], "rest": "approve" } }, { "id": "browserbase", "displayName": "Browserbase API key", "kind": "api-key", "category": "search", "docsUrl": "https://www.browserbase.com/settings", "binding": { "hosts": [ "api.browserbase.com" ], "paths": [ "/v1/**" ] }, "injection": { "in": "header", "name": "X-BB-API-Key", "format": "{key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/sessions", "/v1/fetch", "/v1/search" ], "note": "starts a browser session, fetches pages and searches" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "reads", "starts a browser session, fetches pages and searches" ], "approve": [], "deny": [], "rest": "approve" } }, { "id": "elevenlabs", "displayName": "ElevenLabs API key", "kind": "api-key", "category": "search", "docsUrl": "https://elevenlabs.io/app/settings/api-keys", "binding": { "hosts": [ "api.elevenlabs.io" ] }, "injection": { "in": "header", "name": "xi-api-key", "format": "{key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v1/text-to-speech/*", "/v1/text-to-speech/*/stream", "/v1/text-to-speech/*/with-timestamps", "/v1/text-to-speech/*/stream/with-timestamps", "/v1/text-to-dialogue", "/v1/text-to-dialogue/stream", "/v1/text-to-dialogue/with-timestamps", "/v1/text-to-dialogue/stream/with-timestamps", "/v1/speech-to-text", "/v1/sound-generation", "/v1/audio-isolation", "/v1/audio-isolation/stream", "/v1/forced-alignment" ], "note": "speech, transcription and sound" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/service-accounts/**", "/v1/workspaces/api-keys/**" ], "note": "service accounts, API keys and their settings" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/workspace/invites/**", "/v1/workspace/members/**", "/v1/workspace/groups/**", "/v1/workspace/auth-connections/**", "/v1/workspace/resources/*/share" ], "note": "invitations, members, groups, sign-in connections and sharing give someone else access" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1/workspace/webhooks/**" ], "note": "webhooks" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "reads", "speech, transcription and sound" ], "approve": [], "deny": [ "service accounts, API keys and their settings", "invitations, members, groups, sign-in connections and sharing give someone else access", "webhooks" ], "rest": "approve" } }, { "id": "heygen", "displayName": "HeyGen API key", "kind": "api-key", "category": "search", "docsUrl": "https://app.heygen.com/settings?nav=API", "binding": { "hosts": [ "api.heygen.com" ] }, "injection": { "in": "header", "name": "X-Api-Key", "format": "{key}" }, "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/v3/models/audio/tts", "/v3/models/audio/tts/stream", "/v3/voices/speech" ], "note": "text to speech" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/v3/videos", "/v3/video-agents", "/v3/models/videos", "/v2/video/generate" ], "note": "renders a video, which spends credits" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/v3/avatars/**", "/v3/models/audio/voices", "/v3/voices" ], "note": "creates an avatar or clones a voice" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v3/webhooks/**", "/v1/webhook/**" ], "note": "webhooks" } ] }, "ceiling": "placeholder", "fields": { "key": { "label": "API key" } }, "policySummary": { "allowed": [ "reads", "text to speech" ], "approve": [ "renders a video, which spends credits", "creates an avatar or clones a voice" ], "deny": [ "webhooks" ], "rest": "approve" } }, { "id": "google-oauth-client", "displayName": "Google OAuth client", "kind": "oauth-client", "category": "clients", "docsUrl": "https://console.cloud.google.com/apis/credentials", "binding": { "hosts": [ "oauth2.googleapis.com" ], "paths": [ "/token", "/revoke" ], "methods": [ "POST" ] }, "injection": null, "policy": { "default": "allow", "rules": [] }, "ceiling": "relay", "fields": { "client_id": { "label": "Client ID", "pattern": "\\.apps\\.googleusercontent\\.com$" }, "client_secret": { "label": "Client secret", "pattern": "^GOCSPX-" } }, "prefixes": [ "GOCSPX-" ], "setup": { "title": "In Google Cloud", "redirectUri": "/oauth/callback", "steps": [ { "title": "Open the credentials page", "body": "Sign in to Google Cloud and pick a project, or create one; its name does not matter.", "docs": true }, { "title": "Enable the API the connection needs", "body": "APIs and services, then Library: search for Gmail, Calendar or Drive, whichever the connection is for, and press Enable." }, { "title": "Set up the consent screen", "body": "Google auth platform, then Branding. Name the app Mehen. Choose Internal if this is a Google Workspace account. Otherwise choose External and add your own address as a test user.", "warn": "If it is External, publish the app (Audience, then Publish app). Otherwise Google signs you out every seven days and the vault asks you to reconnect. Published or not, the first sign-in shows an unverified app warning because the app is yours, not Google's: choose Advanced, then Go to Mehen." }, { "title": "Create a Web application client", "body": "Credentials, then Create credentials, then OAuth client ID. Choose the type Web application and add this redirect URI exactly:", "redirectUri": true, "field": "client_id" }, { "title": "Copy the ID and secret into the form", "body": "Google shows the secret once. Paste both below; the vault seals the secret on this device before it leaves.", "field": "client_secret" } ] }, "policySummary": { "allowed": [], "approve": [], "deny": [], "rest": "allowed" } }, { "id": "github-oauth-client", "displayName": "GitHub OAuth app", "kind": "oauth-client", "category": "clients", "docsUrl": "https://github.com/settings/developers", "binding": { "hosts": [ "github.com" ], "paths": [ "/login/oauth/access_token" ], "methods": [ "POST" ] }, "injection": null, "policy": { "default": "allow", "rules": [] }, "ceiling": "relay", "fields": { "client_id": { "label": "Client ID" }, "client_secret": { "label": "Client secret" } }, "policySummary": { "allowed": [], "approve": [], "deny": [], "rest": "allowed" } }, { "id": "microsoft-oauth-client", "displayName": "Microsoft Entra app registration", "kind": "oauth-client", "category": "clients", "docsUrl": "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade", "binding": { "hosts": [ "login.microsoftonline.com" ], "paths": [ "/common/oauth2/v2.0/token" ], "methods": [ "POST" ] }, "injection": null, "policy": { "default": "allow", "rules": [] }, "ceiling": "relay", "fields": { "client_id": { "label": "Application (client) ID" }, "client_secret": { "label": "Client secret value" } }, "policySummary": { "allowed": [], "approve": [], "deny": [], "rest": "allowed" } } ], "oauthProviders": [ { "id": "google-gmail", "family": "google", "displayName": "Gmail", "category": "mail", "docsUrl": "https://developers.google.com/gmail/api/auth/scopes", "clientTemplate": "google-oauth-client", "auth": { "kind": "oauth2", "authorizeUrl": "https://accounts.google.com/o/oauth2/v2/auth", "tokenUrl": "https://oauth2.googleapis.com/token", "revokeUrl": "https://oauth2.googleapis.com/revoke", "pkce": "S256", "clientAuth": "client_secret_post", "tokenRequestFormat": "form", "scopes": { "separator": " ", "param": "scope", "identity": [ "openid", "email" ], "identityScopes": [ "openid", "email", "profile", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.profile" ], "defaults": [ "https://www.googleapis.com/auth/gmail.modify" ], "allowed": [ "https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/gmail.metadata", "https://www.googleapis.com/auth/gmail.labels", "https://www.googleapis.com/auth/gmail.compose", "https://www.googleapis.com/auth/gmail.send", "https://www.googleapis.com/auth/gmail.modify", "https://www.googleapis.com/auth/gmail.insert" ], "shortPrefix": "https://www.googleapis.com/auth/" }, "authorizeParams": { "access_type": "offline", "prompt": "consent select_account" }, "accountHint": { "param": "login_hint" }, "tokenResponse": { "accessToken": "access_token", "refreshToken": "refresh_token", "expiresIn": "expires_in", "refreshTokenExpiresIn": "refresh_token_expires_in", "grantedScopes": "scope" } }, "identity": { "from": "request", "request": { "method": "GET", "url": "https://openidconnect.googleapis.com/v1/userinfo" }, "subject": "sub", "label": "email" }, "upstream": { "baseUrl": "https://gmail.googleapis.com", "binding": { "hosts": [ "gmail.googleapis.com" ], "paths": [ "/gmail/v1/**", "/upload/gmail/v1/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {access_token}" } }, "refresh": { "mode": "refresh_token", "rotation": "none", "marginSeconds": 300, "terminalErrors": [ "invalid_grant" ], "clientErrors": [ "invalid_client", "unauthorized_client" ] }, "lifetimes": { "accessTokenSeconds": 3600, "refreshTokenIdleSeconds": 15552000, "liveRefreshTokensPerClient": 100, "testingModeRefreshSeconds": 604800 }, "defaultPolicy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/gmail/v1/users/*/drafts", "/upload/gmail/v1/users/*/drafts" ], "note": "creates a draft" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/gmail/v1/users/*/messages/*/modify", "/gmail/v1/users/*/threads/*/modify", "/gmail/v1/users/*/messages/batchModify" ], "note": "changes labels" } ] }, "sensitiveEndpoints": [ { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/gmail/v1/users/*/settings/forwardingAddresses", "/gmail/v1/users/*/settings/forwardingAddresses/**", "/gmail/v1/users/*/settings/autoForwarding" ], "why": "forwarding sends every message elsewhere" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/gmail/v1/users/*/settings/delegates", "/gmail/v1/users/*/settings/delegates/**" ], "why": "delegates give someone else the mailbox" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/gmail/v1/users/*/settings/filters", "/gmail/v1/users/*/settings/filters/**" ], "why": "filters can forward or hide mail" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/gmail/v1/users/*/settings/sendAs", "/gmail/v1/users/*/settings/sendAs/**" ], "why": "send-as identities" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/gmail/v1/users/*/settings/**" ], "why": "mailbox settings, POP and IMAP included" }, { "action": "deny", "methods": [ "POST" ], "paths": [ "/gmail/v1/users/*/watch" ], "why": "push notifications to another project" }, { "action": "deny", "paths": [ "/gmail/v1/users/*/drafts/send", "/upload/gmail/v1/users/*/drafts/send" ], "why": "sending a saved draft by id cannot show you what is sent; send the whole message with messages/send and raw instead" }, { "action": "approve", "methods": [ "POST", "PUT" ], "paths": [ "/gmail/v1/users/*/messages/send", "/upload/gmail/v1/users/*/messages/send" ], "why": "sends email as you" }, { "action": "approve", "methods": [ "POST", "PUT" ], "paths": [ "/gmail/v1/users/*/messages/import", "/gmail/v1/users/*/messages/insert", "/upload/gmail/v1/users/*/messages/import", "/upload/gmail/v1/users/*/messages/insert" ], "why": "puts a message with any sender into the mailbox" }, { "action": "approve", "methods": [ "DELETE" ], "paths": [ "/gmail/v1/users/*/messages/*", "/gmail/v1/users/*/threads/*" ], "why": "permanent deletes" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/gmail/v1/users/*/messages/batchDelete" ], "why": "permanent deletes" } ], "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/gmail/v1/users/*/drafts", "/upload/gmail/v1/users/*/drafts" ], "note": "creates a draft" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/gmail/v1/users/*/messages/*/modify", "/gmail/v1/users/*/threads/*/modify", "/gmail/v1/users/*/messages/batchModify" ], "note": "changes labels" }, { "action": "deny", "paths": [ "/gmail/v1/users/*/settings/forwardingAddresses", "/gmail/v1/users/*/settings/forwardingAddresses/**", "/gmail/v1/users/*/settings/autoForwarding" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "forwarding sends every message elsewhere" }, { "action": "deny", "paths": [ "/gmail/v1/users/*/settings/delegates", "/gmail/v1/users/*/settings/delegates/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "delegates give someone else the mailbox" }, { "action": "deny", "paths": [ "/gmail/v1/users/*/settings/filters", "/gmail/v1/users/*/settings/filters/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "filters can forward or hide mail" }, { "action": "deny", "paths": [ "/gmail/v1/users/*/settings/sendAs", "/gmail/v1/users/*/settings/sendAs/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "send-as identities" }, { "action": "deny", "paths": [ "/gmail/v1/users/*/settings/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "mailbox settings, POP and IMAP included" }, { "action": "deny", "paths": [ "/gmail/v1/users/*/watch" ], "methods": [ "POST" ], "note": "push notifications to another project" }, { "action": "deny", "paths": [ "/gmail/v1/users/*/drafts/send", "/upload/gmail/v1/users/*/drafts/send" ], "note": "sending a saved draft by id cannot show you what is sent; send the whole message with messages/send and raw instead" }, { "action": "approve", "paths": [ "/gmail/v1/users/*/messages/send", "/upload/gmail/v1/users/*/messages/send" ], "methods": [ "POST", "PUT" ], "note": "sends email as you" }, { "action": "approve", "paths": [ "/gmail/v1/users/*/messages/import", "/gmail/v1/users/*/messages/insert", "/upload/gmail/v1/users/*/messages/import", "/upload/gmail/v1/users/*/messages/insert" ], "methods": [ "POST", "PUT" ], "note": "puts a message with any sender into the mailbox" }, { "action": "approve", "paths": [ "/gmail/v1/users/*/messages/*", "/gmail/v1/users/*/threads/*" ], "methods": [ "DELETE" ], "note": "permanent deletes" }, { "action": "approve", "paths": [ "/gmail/v1/users/*/messages/batchDelete" ], "methods": [ "POST" ], "note": "permanent deletes" } ] }, "policySummary": { "allowed": [ "reads", "creates a draft", "changes labels" ], "approve": [ "sends email as you", "puts a message with any sender into the mailbox", "permanent deletes" ], "deny": [ "forwarding sends every message elsewhere", "delegates give someone else the mailbox", "filters can forward or hide mail", "send-as identities", "mailbox settings, POP and IMAP included", "push notifications to another project", "sending a saved draft by id cannot show you what is sent; send the whole message with messages/send and raw instead" ], "rest": "approve" } }, { "id": "google-calendar", "family": "google", "displayName": "Google Calendar", "category": "mail", "docsUrl": "https://developers.google.com/calendar/api/auth", "clientTemplate": "google-oauth-client", "auth": { "kind": "oauth2", "authorizeUrl": "https://accounts.google.com/o/oauth2/v2/auth", "tokenUrl": "https://oauth2.googleapis.com/token", "revokeUrl": "https://oauth2.googleapis.com/revoke", "pkce": "S256", "clientAuth": "client_secret_post", "tokenRequestFormat": "form", "scopes": { "separator": " ", "param": "scope", "identity": [ "openid", "email" ], "identityScopes": [ "openid", "email", "profile", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.profile" ], "defaults": [ "https://www.googleapis.com/auth/calendar.events" ], "allowed": [ "https://www.googleapis.com/auth/calendar", "https://www.googleapis.com/auth/calendar.readonly", "https://www.googleapis.com/auth/calendar.events", "https://www.googleapis.com/auth/calendar.events.readonly", "https://www.googleapis.com/auth/calendar.freebusy" ], "shortPrefix": "https://www.googleapis.com/auth/" }, "authorizeParams": { "access_type": "offline", "prompt": "consent select_account" }, "accountHint": { "param": "login_hint" }, "tokenResponse": { "accessToken": "access_token", "refreshToken": "refresh_token", "expiresIn": "expires_in", "refreshTokenExpiresIn": "refresh_token_expires_in", "grantedScopes": "scope" } }, "identity": { "from": "request", "request": { "method": "GET", "url": "https://openidconnect.googleapis.com/v1/userinfo" }, "subject": "sub", "label": "email" }, "upstream": { "baseUrl": "https://www.googleapis.com/calendar/v3", "binding": { "hosts": [ "www.googleapis.com" ], "paths": [ "/calendar/v3/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {access_token}" } }, "refresh": { "mode": "refresh_token", "rotation": "none", "marginSeconds": 300, "terminalErrors": [ "invalid_grant" ], "clientErrors": [ "invalid_client", "unauthorized_client" ] }, "lifetimes": { "accessTokenSeconds": 3600, "refreshTokenIdleSeconds": 15552000, "liveRefreshTokensPerClient": 100, "testingModeRefreshSeconds": 604800 }, "defaultPolicy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/calendar/v3/freeBusy" ], "note": "free/busy query" } ] }, "sensitiveEndpoints": [ { "action": "approve", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/calendar/v3/calendars/*/acl", "/calendar/v3/calendars/*/acl/**" ], "why": "shares a calendar" }, { "action": "approve", "methods": [ "DELETE" ], "paths": [ "/calendar/v3/calendars/*", "/calendar/v3/users/me/calendarList/*" ], "why": "deletes a calendar" }, { "action": "deny", "methods": [ "POST" ], "paths": [ "/calendar/v3/**/watch" ], "why": "push notifications to an outside address" } ], "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/calendar/v3/freeBusy" ], "note": "free/busy query" }, { "action": "approve", "paths": [ "/calendar/v3/calendars/*/acl", "/calendar/v3/calendars/*/acl/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "shares a calendar" }, { "action": "approve", "paths": [ "/calendar/v3/calendars/*", "/calendar/v3/users/me/calendarList/*" ], "methods": [ "DELETE" ], "note": "deletes a calendar" }, { "action": "deny", "paths": [ "/calendar/v3/**/watch" ], "methods": [ "POST" ], "note": "push notifications to an outside address" } ] }, "policySummary": { "allowed": [ "reads", "free/busy query" ], "approve": [ "shares a calendar", "deletes a calendar" ], "deny": [ "push notifications to an outside address" ], "rest": "approve" } }, { "id": "google-drive", "family": "google", "displayName": "Google Drive", "category": "mail", "docsUrl": "https://developers.google.com/drive/api/guides/api-specific-auth", "clientTemplate": "google-oauth-client", "auth": { "kind": "oauth2", "authorizeUrl": "https://accounts.google.com/o/oauth2/v2/auth", "tokenUrl": "https://oauth2.googleapis.com/token", "revokeUrl": "https://oauth2.googleapis.com/revoke", "pkce": "S256", "clientAuth": "client_secret_post", "tokenRequestFormat": "form", "scopes": { "separator": " ", "param": "scope", "identity": [ "openid", "email" ], "identityScopes": [ "openid", "email", "profile", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.profile" ], "defaults": [ "https://www.googleapis.com/auth/drive.file" ], "allowed": [ "https://www.googleapis.com/auth/drive", "https://www.googleapis.com/auth/drive.file", "https://www.googleapis.com/auth/drive.readonly", "https://www.googleapis.com/auth/drive.metadata.readonly", "https://www.googleapis.com/auth/drive.appdata" ], "shortPrefix": "https://www.googleapis.com/auth/" }, "authorizeParams": { "access_type": "offline", "prompt": "consent select_account" }, "accountHint": { "param": "login_hint" }, "tokenResponse": { "accessToken": "access_token", "refreshToken": "refresh_token", "expiresIn": "expires_in", "refreshTokenExpiresIn": "refresh_token_expires_in", "grantedScopes": "scope" } }, "identity": { "from": "request", "request": { "method": "GET", "url": "https://openidconnect.googleapis.com/v1/userinfo" }, "subject": "sub", "label": "email" }, "upstream": { "baseUrl": "https://www.googleapis.com/drive/v3", "binding": { "hosts": [ "www.googleapis.com" ], "paths": [ "/drive/v3/**", "/upload/drive/v3/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {access_token}" } }, "refresh": { "mode": "refresh_token", "rotation": "none", "marginSeconds": 300, "terminalErrors": [ "invalid_grant" ], "clientErrors": [ "invalid_client", "unauthorized_client" ] }, "lifetimes": { "accessTokenSeconds": 3600, "refreshTokenIdleSeconds": 15552000, "liveRefreshTokensPerClient": 100, "testingModeRefreshSeconds": 604800 }, "defaultPolicy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" } ] }, "sensitiveEndpoints": [ { "action": "approve", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/drive/v3/files/*/permissions", "/drive/v3/files/*/permissions/**" ], "why": "shares a file" }, { "action": "approve", "methods": [ "DELETE" ], "paths": [ "/drive/v3/files/*" ], "why": "permanent deletes" }, { "action": "approve", "methods": [ "DELETE" ], "paths": [ "/drive/v3/files/trash" ], "why": "empties the trash" }, { "action": "deny", "methods": [ "POST" ], "paths": [ "/drive/v3/**/watch", "/drive/v3/changes/watch" ], "why": "push notifications to an outside address" } ], "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "approve", "paths": [ "/drive/v3/files/*/permissions", "/drive/v3/files/*/permissions/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "shares a file" }, { "action": "approve", "paths": [ "/drive/v3/files/*" ], "methods": [ "DELETE" ], "note": "permanent deletes" }, { "action": "approve", "paths": [ "/drive/v3/files/trash" ], "methods": [ "DELETE" ], "note": "empties the trash" }, { "action": "deny", "paths": [ "/drive/v3/**/watch", "/drive/v3/changes/watch" ], "methods": [ "POST" ], "note": "push notifications to an outside address" } ] }, "policySummary": { "allowed": [ "reads" ], "approve": [ "shares a file", "permanent deletes", "empties the trash" ], "deny": [ "push notifications to an outside address" ], "rest": "approve" } }, { "id": "github-oauth", "family": "github", "displayName": "GitHub", "category": "code", "docsUrl": "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps", "clientTemplate": "github-oauth-client", "auth": { "kind": "oauth2", "authorizeUrl": "https://github.com/login/oauth/authorize", "tokenUrl": "https://github.com/login/oauth/access_token", "pkce": "S256", "clientAuth": "client_secret_post", "tokenRequestFormat": "form", "scopes": { "separator": " ", "param": "scope", "identity": [], "identityScopes": [], "defaults": [ "read:user" ], "allowed": [ "repo", "public_repo", "read:user", "user:email", "read:org", "gist", "notifications", "workflow", "read:project", "project" ] }, "authorizeParams": { "prompt": "select_account" }, "accountHint": { "param": "login" }, "tokenResponse": { "accessToken": "access_token", "refreshToken": "refresh_token", "expiresIn": "expires_in", "refreshTokenExpiresIn": "refresh_token_expires_in", "grantedScopes": "scope" } }, "identity": { "from": "request", "request": { "method": "GET", "url": "https://api.github.com/user", "headers": { "accept": "application/vnd.github+json" } }, "subject": "id", "label": "login" }, "upstream": { "baseUrl": "https://api.github.com", "binding": { "hosts": [ "api.github.com" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {access_token}" } }, "refresh": { "mode": "never_expires", "rotation": "strict", "marginSeconds": 300, "terminalErrors": [ "invalid_grant", "bad_refresh_token" ], "clientErrors": [ "invalid_client", "incorrect_client_credentials", "unauthorized_client" ] }, "lifetimes": { "refreshTokenIdleSeconds": 31536000 }, "defaultPolicy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/graphql" ], "body": "graphql-query", "note": "read-only GraphQL queries" } ] }, "sensitiveEndpoints": [ { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/user/keys/**", "/user/gpg_keys/**", "/user/ssh_signing_keys/**", "/repos/*/*/keys/**", "/repositories/*/keys/**" ], "why": "SSH, signing and deploy keys" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/repos/*/*/hooks/**", "/repositories/*/hooks/**", "/orgs/*/hooks/**", "/organizations/*/hooks/**" ], "why": "webhooks" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/repos/*/*/collaborators/**", "/repositories/*/collaborators/**", "/repos/*/*/invitations/**", "/repositories/*/invitations/**", "/orgs/*/invitations/**", "/organizations/*/invitations/**", "/orgs/*/memberships/**", "/organizations/*/memberships/**", "/orgs/*/teams/*/memberships/**", "/organizations/*/teams/*/memberships/**", "/orgs/*/outside_collaborators/**", "/organizations/*/outside_collaborators/**", "/user/repository_invitations/**" ], "why": "collaborators, invitations and memberships give someone else access" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/repos/*/*/actions/runners/**", "/repositories/*/actions/runners/**", "/orgs/*/actions/runners/**", "/organizations/*/actions/runners/**", "/orgs/*/actions/runner-groups/**", "/organizations/*/actions/runner-groups/**", "/enterprises/*/actions/runners/**" ], "why": "self-hosted runners and their tokens receive jobs and their secrets" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/repos/*/*/transfer", "/repositories/*/transfer" ], "why": "transfers the repository away" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/user/emails/**", "/user/email/**" ], "why": "account email addresses reset the password" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/applications/**", "/authorizations/**" ], "why": "OAuth tokens and grants" }, { "action": "approve", "paths": [ "/graphql" ], "body": "graphql-mutation", "why": "GraphQL requests that are not plainly a query" } ], "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "allow", "methods": [ "POST" ], "paths": [ "/graphql" ], "body": "graphql-query", "note": "read-only GraphQL queries" }, { "action": "deny", "paths": [ "/user/keys/**", "/user/gpg_keys/**", "/user/ssh_signing_keys/**", "/repos/*/*/keys/**", "/repositories/*/keys/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "SSH, signing and deploy keys" }, { "action": "deny", "paths": [ "/repos/*/*/hooks/**", "/repositories/*/hooks/**", "/orgs/*/hooks/**", "/organizations/*/hooks/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "webhooks" }, { "action": "deny", "paths": [ "/repos/*/*/collaborators/**", "/repositories/*/collaborators/**", "/repos/*/*/invitations/**", "/repositories/*/invitations/**", "/orgs/*/invitations/**", "/organizations/*/invitations/**", "/orgs/*/memberships/**", "/organizations/*/memberships/**", "/orgs/*/teams/*/memberships/**", "/organizations/*/teams/*/memberships/**", "/orgs/*/outside_collaborators/**", "/organizations/*/outside_collaborators/**", "/user/repository_invitations/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "collaborators, invitations and memberships give someone else access" }, { "action": "deny", "paths": [ "/repos/*/*/actions/runners/**", "/repositories/*/actions/runners/**", "/orgs/*/actions/runners/**", "/organizations/*/actions/runners/**", "/orgs/*/actions/runner-groups/**", "/organizations/*/actions/runner-groups/**", "/enterprises/*/actions/runners/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "self-hosted runners and their tokens receive jobs and their secrets" }, { "action": "deny", "paths": [ "/repos/*/*/transfer", "/repositories/*/transfer" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "transfers the repository away" }, { "action": "deny", "paths": [ "/user/emails/**", "/user/email/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "account email addresses reset the password" }, { "action": "deny", "paths": [ "/applications/**", "/authorizations/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "OAuth tokens and grants" }, { "action": "approve", "paths": [ "/graphql" ], "body": "graphql-mutation", "note": "GraphQL requests that are not plainly a query" } ] }, "policySummary": { "allowed": [ "reads", "read-only GraphQL queries" ], "approve": [ "GraphQL requests that are not plainly a query" ], "deny": [ "SSH, signing and deploy keys", "webhooks", "collaborators, invitations and memberships give someone else access", "self-hosted runners and their tokens receive jobs and their secrets", "transfers the repository away", "account email addresses reset the password", "OAuth tokens and grants" ], "rest": "approve" } }, { "id": "microsoft-graph", "family": "microsoft", "displayName": "Microsoft 365 (Graph)", "category": "mail", "docsUrl": "https://learn.microsoft.com/en-us/graph/permissions-reference", "clientTemplate": "microsoft-oauth-client", "auth": { "kind": "oauth2", "authorizeUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize", "tokenUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/token", "pkce": "S256", "clientAuth": "client_secret_post", "tokenRequestFormat": "form", "scopes": { "separator": " ", "param": "scope", "identity": [ "openid", "profile", "email" ], "offline": "offline_access", "identityScopes": [ "openid", "profile", "email", "offline_access" ], "defaults": [ "User.Read" ], "allowed": [ "User.Read", "Mail.Read", "Mail.ReadWrite", "Mail.Send", "Calendars.Read", "Calendars.ReadWrite", "Contacts.Read", "Contacts.ReadWrite", "Files.Read", "Files.ReadWrite", "Tasks.ReadWrite" ] }, "authorizeParams": { "prompt": "select_account" }, "accountHint": { "param": "login_hint" }, "tokenResponse": { "accessToken": "access_token", "refreshToken": "refresh_token", "expiresIn": "expires_in", "grantedScopes": "scope", "idToken": "id_token" } }, "identity": { "from": "id_token", "subject": "oid", "tenant": "tid", "label": "preferred_username" }, "upstream": { "baseUrl": "https://graph.microsoft.com/v1.0", "binding": { "hosts": [ "graph.microsoft.com" ], "paths": [ "/v1.0/**", "/beta/**" ] }, "injection": { "in": "header", "name": "Authorization", "format": "Bearer {access_token}" } }, "refresh": { "mode": "refresh_token", "rotation": "lenient", "marginSeconds": 300, "terminalErrors": [ "invalid_grant" ], "clientErrors": [ "invalid_client", "unauthorized_client" ] }, "lifetimes": { "accessTokenSeconds": 3600, "refreshTokenIdleSeconds": 7776000 }, "defaultPolicy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" } ] }, "sensitiveEndpoints": [ { "action": "deny", "paths": [ "/v1.0/$batch", "/beta/$batch" ], "why": "a batch carries requests the vault cannot check one by one; send the requests one by one" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1.0/**/messageRules/**", "/v1.0/**/inboxRules/**", "/beta/**/messageRules/**", "/beta/**/inboxRules/**" ], "why": "mailbox rules can forward or hide mail" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1.0/**/mailboxSettings/**", "/beta/**/mailboxSettings/**" ], "why": "forwarding and automatic replies" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1.0/applications", "/v1.0/applications/**", "/v1.0/servicePrincipals", "/v1.0/servicePrincipals/**", "/v1.0/oauth2PermissionGrants", "/v1.0/oauth2PermissionGrants/**", "/beta/applications", "/beta/applications/**", "/beta/servicePrincipals", "/beta/servicePrincipals/**", "/beta/oauth2PermissionGrants", "/beta/oauth2PermissionGrants/**" ], "why": "app registrations and grants" }, { "action": "deny", "methods": [ "POST", "PATCH" ], "paths": [ "/v1.0/subscriptions", "/v1.0/subscriptions/**", "/beta/subscriptions", "/beta/subscriptions/**" ], "why": "change notifications to an outside address" }, { "action": "deny", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1.0/**/send", "/v1.0/**/microsoft.graph.send", "/v1.0/**/reply", "/v1.0/**/microsoft.graph.reply", "/v1.0/**/replyAll", "/v1.0/**/microsoft.graph.replyAll", "/v1.0/**/forward", "/v1.0/**/microsoft.graph.forward", "/beta/**/send", "/beta/**/microsoft.graph.send", "/beta/**/reply", "/beta/**/microsoft.graph.reply", "/beta/**/replyAll", "/beta/**/microsoft.graph.replyAll", "/beta/**/forward", "/beta/**/microsoft.graph.forward" ], "why": "sending, replying to or forwarding a stored message by id cannot show you what is sent; send the whole message with sendMail instead" }, { "action": "approve", "methods": [ "POST" ], "paths": [ "/v1.0/**/sendMail", "/v1.0/**/microsoft.graph.sendMail", "/beta/**/sendMail", "/beta/**/microsoft.graph.sendMail" ], "why": "sends email as you" }, { "action": "approve", "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "paths": [ "/v1.0/**/permissions", "/v1.0/**/permissions/**", "/v1.0/**/invite", "/v1.0/**/createLink", "/beta/**/permissions", "/beta/**/permissions/**", "/beta/**/invite", "/beta/**/createLink" ], "why": "shares a file" } ], "policy": { "default": "approve", "rules": [ { "action": "allow", "methods": [ "GET", "HEAD" ], "note": "reads" }, { "action": "deny", "paths": [ "/v1.0/$batch", "/beta/$batch" ], "note": "a batch carries requests the vault cannot check one by one; send the requests one by one" }, { "action": "deny", "paths": [ "/v1.0/**/messageRules/**", "/v1.0/**/inboxRules/**", "/beta/**/messageRules/**", "/beta/**/inboxRules/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "mailbox rules can forward or hide mail" }, { "action": "deny", "paths": [ "/v1.0/**/mailboxSettings/**", "/beta/**/mailboxSettings/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "forwarding and automatic replies" }, { "action": "deny", "paths": [ "/v1.0/applications", "/v1.0/applications/**", "/v1.0/servicePrincipals", "/v1.0/servicePrincipals/**", "/v1.0/oauth2PermissionGrants", "/v1.0/oauth2PermissionGrants/**", "/beta/applications", "/beta/applications/**", "/beta/servicePrincipals", "/beta/servicePrincipals/**", "/beta/oauth2PermissionGrants", "/beta/oauth2PermissionGrants/**" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "app registrations and grants" }, { "action": "deny", "paths": [ "/v1.0/subscriptions", "/v1.0/subscriptions/**", "/beta/subscriptions", "/beta/subscriptions/**" ], "methods": [ "POST", "PATCH" ], "note": "change notifications to an outside address" }, { "action": "deny", "paths": [ "/v1.0/**/send", "/v1.0/**/microsoft.graph.send", "/v1.0/**/reply", "/v1.0/**/microsoft.graph.reply", "/v1.0/**/replyAll", "/v1.0/**/microsoft.graph.replyAll", "/v1.0/**/forward", "/v1.0/**/microsoft.graph.forward", "/beta/**/send", "/beta/**/microsoft.graph.send", "/beta/**/reply", "/beta/**/microsoft.graph.reply", "/beta/**/replyAll", "/beta/**/microsoft.graph.replyAll", "/beta/**/forward", "/beta/**/microsoft.graph.forward" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "sending, replying to or forwarding a stored message by id cannot show you what is sent; send the whole message with sendMail instead" }, { "action": "approve", "paths": [ "/v1.0/**/sendMail", "/v1.0/**/microsoft.graph.sendMail", "/beta/**/sendMail", "/beta/**/microsoft.graph.sendMail" ], "methods": [ "POST" ], "note": "sends email as you" }, { "action": "approve", "paths": [ "/v1.0/**/permissions", "/v1.0/**/permissions/**", "/v1.0/**/invite", "/v1.0/**/createLink", "/beta/**/permissions", "/beta/**/permissions/**", "/beta/**/invite", "/beta/**/createLink" ], "methods": [ "POST", "PUT", "PATCH", "DELETE" ], "note": "shares a file" } ] }, "policySummary": { "allowed": [ "reads" ], "approve": [ "sends email as you", "shares a file" ], "deny": [ "a batch carries requests the vault cannot check one by one; send the requests one by one", "mailbox rules can forward or hide mail", "forwarding and automatic replies", "app registrations and grants", "change notifications to an outside address", "sending, replying to or forwarding a stored message by id cannot show you what is sent; send the whole message with sendMail instead" ], "rest": "approve" } } ], "redirectUri": "https://app.mehen.dev/oauth/callback" }