One-install Airbyte Cloud front door over six bounded capability packs and 30 non-chat, uncached, read-only workflows. It admits 89 of 92 official public operations across 48 paths: health; Applications and Embedded; jobs, sources, destinations, connections, streams, and tags; connector definitions; regions and dataplanes; and workspace, organization, user, permission, and group administration. The documentation redirect and OAuth callback are excluded as browser surfaces. The secret-bearing access-token endpoint is excluded from recipes and used only inside the trusted connection adapter, which supports Airbyte's short-lived OAuth2 client-credentials tokens. Health is connectionless; all other admitted operations use the selected encrypted Airbyte Application connection. All 35 admitted JSON bodies are required and sent verbatim, including the six whose OpenAPI omits requestBody.required. Seven documented limit/offset collections automatically request 100 records per page. Three definition collections expose response links without request continuation parameters and remain explicit single-page gaps. includeSecretCoordinates is fixed false. Client-secret and connector-configuration reads remain callable but are excluded from bundled rendering workflows. Reads are uncached and not approval-gated, every mutation requires approval, unsafe response integers remain exact strings, and provider failures surface without hidden retries. No pipeline or administration object is claimed as a task, note, or user-work project Source.