One-install Aiven front door over 8 bounded domain packs and 18 non-chat, uncached, read-only workflows. It admits all 399 nondeprecated operations across 322 official paths and excludes exactly 65 provider-deprecated operations. Organizations, accounts, users, billing, projects, clouds, VPCs, services, integrations, Kafka, MirrorMaker, Flink, PostgreSQL, OpenSearch, ClickHouse, MySQL, and Thanos are covered. The vendor-hosted OpenAPI is mutable but generation fails closed unless its 1,821,442 bytes retain SHA-256 aedf71cf0f9d0e2587ae941a67adf563a14b2c5417697df77c6067f38d9067fe; the official API guide independently pins https://api.aiven.io/v1 and the exact Authorization: aivenv1 TOKEN format. Wire calls use the origin-only base plus /v1 paths, and openapi_source.path_alias strips that documented server prefix during proof. Four optional repeated query arrays omit item schemas and are omitted because the closed operation request-schema gate cannot express arrays; two string filters misuse numeric bounds, so those values are applied as string lengths. Three non-JSON downloads become private file_refs. Two exact pagination loops are automatic; two next-page strings whose cursor-vs-URL shape is unspecified stay explicitly manual. Twenty POST-shaped reports, lists, fetches, validations, compatibility checks, or analyses are classified as reads; twelve generic-looking updates with power-off, arbitrary SQL, credential rotation, maintenance, service-type, or deleting-tag authority are explicitly destructive. JSON bodies remain verbatim and unsafe response integers remain exact strings. Reads are uncached and not approval-gated; every mutation requires approval. No task, note, or project Source is claimed for infrastructure containers or runtime executions.