Marketplace

API capability pack for bounded Box metadata operations against https://api.box.com/2.0 only. Reads the current user, file and folder metadata, folder items, recent items, file versions, file comments, review tasks, task assignments, and content metadata search results. Supports approval-gated daily organization and review actions: create folders, rename or move files/folders, copy files/folders, create/update comments, create/update file review tasks, and assign/update task assignments. File upload/download, delete/trash, restore, shared-link management, locks, permissions, tags, folder upload email, collaboration management, comment removal, task removal, task unassignment, and arbitrary passthrough are intentionally not exposed in this metadata pack. Enroll a Box OAuth access token connection as bearer auth; no credential is embedded in the manifest.

API capability pack for bounded Brave Search API operations against https://api.search.brave.com/res/v1 only. Enroll a Brave Search API subscription-token connection named brave-search that injects the X-Subscription-Token header; no credential is embedded in this manifest. The pack reads web search, LLM context, news, image, and video search results for privacy-first research, source discovery, market monitoring, and RAG grounding workflows. It bundles a web research brief, a news monitor brief, and a media discovery brief. The pack intentionally excludes POST variants, Answers API, rich-search callback flows, local POI detail endpoints, Goggles definitions, autosuggest, spellcheck-only calls, arbitrary Brave API passthrough, dynamic callback URLs, and any operation outside api.search.brave.com/res/v1.

API capability pack for bounded Brevo API v3 operations against https://api.brevo.com only. Reads account metadata, contacts, contact attributes, folders, lists, campaigns, campaign share and A/B-test data, transactional templates, transactional email history, transactional reports, email events, and blocked transactional contacts; can create/update one contact, create/update one folder or list, add/remove explicit emails from a list, send/test one campaign or transactional template/email, update one campaign status, and unblock one transactional contact. Enroll a Brevo API-key connection as header auth using api-key; no credential is embedded in the manifest. Writes are approval-gated. The pack intentionally excludes contact deletion, list/folder deletion, all-contact list removal, bulk imports/exports, campaign creation/content editing/deletion, template create/update/delete, SMS/WhatsApp sends, webhook management, custom objects, loyalty, conversations, eCommerce, and arbitrary API passthrough.

One-install Brex front door over nine separately pinned official API domains: accounting records, budgets and spend limits, expenses, custom fields, vendors and transfer status, team and non-PAN card controls, accounts/transactions/statements, travel, and webhook inventory. It bundles seven read-only operating views plus approval-gated expense-memo, vendor, user-invite, and v2-budget intakes. Dependency installs grant the read surface; each write/admin dependency group must be granted explicitly and still asks per run. The suite intentionally excludes partner-only Onboarding client credentials, accounting-integration lifecycle/export reporting, receipt upload/match, money movement, vendor deletion, PAN/CVV or secure-card email, custom-field deletion, webhook secrets/mutation, deprecated v1 budget writes, arbitrary passthrough, and credentials in arguments.

Officially pinned Brex Accounting API capability pack for bounded accounting-record queries and reads at https://api.brex.com. It exposes no integration connect/disconnect/reactivate action and never reports export results back to Brex.

Officially pinned Brex Budgets API capability pack. It reads budget programs, legacy v1 spend limits, v2 budgets, and v2 spend limits; creates, updates, or archives only v2 budgets and spend limits behind explicit approval. It never writes deprecated v1 spend limits.

Officially pinned Brex Expenses API capability pack. It reads the current unified expense list and individual expenses and allows only approval-gated memo updates. It excludes deprecated card-list/read routes, receipt match, receipt upload, file upload, and arbitrary endpoints.

Officially pinned Brex Fields API beta capability pack. It reads fields and values and approval-gates field create/update and value create/update operations. Deletes are intentionally excluded; bulk value writes remain bounded by Brex's documented request limits.

Officially pinned Brex Payments API capability pack. It reads linked accounts, transfer status, and vendors, and approval-gates vendor create/update only. It never creates incoming or outgoing transfers, sends ACH/wires/checks, deletes vendors, or exposes arbitrary payment endpoints.

Officially pinned Brex Team API capability pack for company, people, organization dimensions, limits, and card lifecycle. Reads exclude PAN/CVV and secure-email delivery. Every invite, profile/limit change, card create/update/lock/unlock, and termination is approval-gated; card termination always requires approval.

Officially pinned read-only Brex Transactions API capability pack. It reads card and cash accounts, card and cash statements, and card and cash transactions in bounded pages. It exposes no mutation, transfer creation, credential route, or arbitrary API passthrough.

Officially pinned read-only Brex Travel API capability pack. It reads trips and bookings in bounded pages and exposes no booking, cancellation, traveler mutation, payment, or arbitrary endpoint.

Officially pinned read-only Brex Webhooks API capability pack. It inventories subscriptions, groups, and group members. It intentionally excludes webhook secrets plus every create, update, delete, add-member, and remove-member route.

V3 deterministic Brotli compression capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local brotli CLI ingredient exposes readiness, best/default compression, fast compression, decompression, and compressed-stream integrity testing. Fixed-function and reproducible: the executor materializes source files and owns the throwaway output directory, while brotli writes fixed output files that are captured as result.file_ref. Write-tier operations write only to an engine-managed output dir, read-tier testing returns only exit status, and recipes cannot pass arbitrary flags, dictionaries, comments, large-window modes, source-removal flags, shell wrappers, or caller-controlled output paths. Requires the brotli binary on PATH (Debian/Ubuntu: apt install brotli; macOS: brew install brotli). Local and no-egress.

API capability pack for bounded Browserbase REST API operations against https://api.browserbase.com/v1 only. Enroll a Browserbase API-key connection named browserbase that injects the X-BB-API-Key header; no credential is embedded in this manifest. The pack creates and releases Browserbase browser sessions, reads session status, live inspector URLs, logs, recordings, projects, project usage, and context metadata, and creates context upload slots for browser automation launch, debugging, usage monitoring, and reusable browser-environment setup. Session and context creation are write-tier operations that consume Browserbase capacity and require approval. The pack intentionally excludes arbitrary browser-control traffic, Playwright/CDP/WebDriver command execution, session uploads, downloads, extensions, certificates, search/fetch/functions/agents APIs, external proxy configuration and proxy credentials, dynamic callbacks, delete-context operations, custom host switching, and arbitrary Browserbase API passthrough.

API capability pack for bounded Buffer GraphQL operations against https://api.buffer.com only. Reads the authenticated account, organizations, connected social channels, scheduled/sent/error posts, daily posting limits, aggregate post metrics, idea groups, and content ideas. Bundles a scheduled channel/posts digest, an AI-assisted content calendar brief, and approval-gated workflows for creating one scheduled post or one idea. Enroll a Buffer API key or OAuth access token connection as bearer auth; no credential is embedded in the manifest. Writes are approval-gated and limited to create/edit one post or create one idea. The pack intentionally excludes post deletion, queue reordering, arbitrary GraphQL passthrough, channel/account mutation, team/admin management, OAuth app management, uploads beyond documented remote asset inputs, and unsupported social-network-specific automation.

V3 Bun JavaScript/TypeScript toolchain capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local bun CLI ingredient exposes bounded project operations for readiness, lockfile freshness checks, installed dependency inspection, dependency vulnerability audit, package publish dry-run inspection, and targeted Bun test execution. Project operations run from an explicit project directory cwd supplied at execution time through the native cli_invocation cwd field, avoid caller-supplied bun flags, avoid shell wrappers, and keep diagnostics visible as text or JSON output. Lock checks use frozen-lockfile dry-run mode and skip lifecycle scripts. Dependency audit is approval-gated because installed package names and versions are sent to npm. Test execution is approval-gated because Bun tests execute project JavaScript and TypeScript. Requires bun on PATH.

V3 deterministic GitHub Actions workflow lint capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local actionlint CLI ingredient exposes bounded project operations for readiness and GitHub Actions workflow lint diagnostics. Lints run from an explicit project directory cwd supplied at execution time, check one trusted local GitHub Actions workflow YAML file, and return JSON diagnostics via the github_actions.workflow_lint catalog operation. Fixed-function and reproducible: no arbitrary actionlint flags, no caller-supplied config path, no shell wrapper, no Docker image, no workflow execution, and no network egress. ShellCheck and Pyflakes integrations are disabled so the pack depends only on actionlint and never spawns secondary linters. Findings are represented as JSON output instead of failing the op; real invocation errors still fail. Requires actionlint on PATH. Local and no-egress.

API capability pack for bounded Acuity Scheduling API v1 operations against https://acuityscheduling.com/api/v1. Enroll an Acuity HTTP Basic Auth connection named acuity using the account's numeric user ID and API key, or an OAuth-backed connection that can call the same API. The pack reads account metadata, appointment types, calendars, clients, intake forms, appointment add-ons, availability dates, availability times, available classes, appointments, and appointment payments for front-desk scheduling, coaching, classes, consultations, and service business workflows. It bundles a scheduled appointment digest, AI-assisted appointment and availability briefs, and approval-gated workflows for creating one appointment, updating whitelisted appointment details, rescheduling one appointment, canceling one appointment, and blocking one calendar time window. The pack intentionally excludes appointment type mutation, calendar mutation, client mutation, form mutation, package or certificate creation, webhook creation or deletion, block deletion, appointment deletion, report exports, OAuth token endpoints, and arbitrary Acuity API passthrough.

One-install Adobe Acrobat Sign REST API v6 front door over three bounded domain packs and seven existing e-signature workflows. The suite publishes 158 executable catalog operations covering 154 of 184 unique routes from Adobe's hash-pinned live OpenAPI 6.0.0; the prior root exposed 15 operations. This version-2 root preserves all 15 operation IDs and workflow routes while dependencies add 143 operations, including four complete cursor-walk aliases. 30 fail-closed exclusions cover multipart uploads, a required DELETE body, POST binary downloads, OAuth-secret webhook endpoint contracts, privileged manage/signing links, and secure document URL responses that have private file_ref download alternatives. The root deliberately omits openapi_source because its user.me compatibility route uses the officially documented literal me expansion of /users/{userId}, which the structural path prover cannot represent; every leaf is pinned...

Workflow pack for Recued-sent Adobe Sign agreements. It composes the Adobe Sign capability pack with a closure ledger: create one agreement through the existing Adobe Sign approval gate, persist only the agreement/library-document/workflow linkage in data.shared when the agreement is sent with IN_PROCESS, and let a scheduled watcher re-read that exact agreement until Adobe Sign reports a role-specific completion status such as signed/approved/delivered/accepted/form_filled, or an exception status such as aborted/cancelled/expired/archived. This pack does not duplicate Adobe Sign reminders, participant notifications, expiration settings, webhook administration, agreement status dashboards, cancellation flows, or MegaSign/bulk sends; it adds Recued-visible closure state for agreements Recued sent.

Adobe Acrobat Sign agreement lifecycle, documents, participants, reminders, notes, events, workflows, message templates, and cross-resource search. Generated from Adobe's hash-pinned live OpenAPI 6.0.0. This leaf carries 36 of the suite's 158 executable catalog operations over 154 unique admitted routes. The representative NA1 origin is only an enrollment default; use the connection base_url for the account's apiAccessPoint. Full /api/rest/v6 paths remain correct whether that connection stores the tenant origin or the versioned API root. Reads are uncached and require no approval, mutations require approval, binary GET responses become private file_refs, and credentials, privileged action links, secure document URL responses, multipart uploads, DELETE bodies, and POST binary downloads remain fail-closed exclusions.

Adobe Acrobat Sign accounts, groups, users, webhooks, webhook endpoints, recipient groups, electronic seals, signing reasons, settings, logos, and events. Generated from Adobe's hash-pinned live OpenAPI 6.0.0. This leaf carries 38 of the suite's 158 executable catalog operations over 154 unique admitted routes. The representative NA1 origin is only an enrollment default; use the connection base_url for the account's apiAccessPoint. Full /api/rest/v6 paths remain correct whether that connection stores the tenant origin or the versioned API root. Reads are uncached and require no approval, mutations require approval, binary GET responses become private file_refs, and credentials, privileged action links, secure document URL responses, multipart uploads, DELETE bodies, and POST binary downloads remain fail-closed exclusions.

Adobe Acrobat Sign reusable library documents, web forms, Send in Bulk resources, form fields, documents, events, members, reminders, shares, and isolated downloads. Generated from Adobe's hash-pinned live OpenAPI 6.0.0. This leaf carries 69 of the suite's 158 executable catalog operations over 154 unique admitted routes. The representative NA1 origin is only an enrollment default; use the connection base_url for the account's apiAccessPoint. Full /api/rest/v6 paths remain correct whether that connection stores the tenant origin or the versioned API root. Reads are uncached and require no approval, mutations require approval, binary GET responses become private file_refs, and credentials, privileged action links, secure document URL responses, multipart uploads, DELETE bodies, and POST binary downloads remain fail-closed exclusions.

One-install Adyen front door over nine bounded domain packs and eleven operating workflows. It admits 250 of 276 operations from the latest Checkout v72, Management v3, Balance Platform Configuration v2, Transfers v4, and Disputes v30 official specifications: all nondeprecated operations with buildable static REST transport except raw card and PIN reveal, network-token activation secrets, API-key, client-key, password, and HMAC-secret issuance, third-party stored-payment-detail forwarding, and two SCA-association mutations that require a fresh per-request SCA credential. Checkout uses the merchant-specific live hostname and documented /checkout/v72 prefix. Every mutation requires approval every run, and every secret-bearing terminal-setting or payment-method read is marked sensitive-read; every admitted POST mutation requires caller-owned idempotency; no bundled workflow captures, refunds, transfers, cashes out, accepts, or defends automatically.

Adyen Balance Platform Configuration v2 account holders, balance accounts, platform metadata, and balance-platform webhook settings. Generated from Adyen current official commit-pinned OpenAPI 3.1 source. Every mutation is grant-off, requires approval every run, and every admitted POST mutation requires a caller-owned idempotency key of at most 64 characters. Reads are uncached; the seven terminal-setting and payment-method reads whose official schemas can materialize passcodes or acquirer credentials are marked sensitive-read. Auth is connection-owned, pagination follows provider links or documented offsets, and no financial resource is misrepresented as a work-entity Source.

Adyen Balance Platform Configuration v2 card orders, safe payment-instrument administration, network tokens, authorized users, and SCA devices without card-secret reveal routes. Generated from Adyen current official commit-pinned OpenAPI 3.1 source. Every mutation is grant-off, requires approval every run, and every admitted POST mutation requires a caller-owned idempotency key of at most 64 characters. Reads are uncached; the seven terminal-setting and payment-method reads whose official schemas can materialize passcodes or acquirer credentials are marked sensitive-read. Auth is connection-owned, pagination follows provider links or documented offsets, and no financial resource is misrepresented as a work-entity Source.

Adyen Balance Platform Configuration v2 sweeps, payout schedules, transfer limits and routes, transaction rules, bank validation, and direct-debit mandates. Generated from Adyen current official commit-pinned OpenAPI 3.1 source. Every mutation is grant-off, requires approval every run, and every admitted POST mutation requires a caller-owned idempotency key of at most 64 characters. Reads are uncached; the seven terminal-setting and payment-method reads whose official schemas can materialize passcodes or acquirer credentials are marked sensitive-read. Auth is connection-owned, pagination follows provider links or documented offsets, and no financial resource is misrepresented as a work-entity Source.

Adyen Checkout v72 sessions, payment methods, payments, modifications, orders, recurring tokens, donations, and payment links. Generated from Adyen current official commit-pinned OpenAPI 3.1 source. Every mutation is grant-off, requires approval every run, and every admitted POST mutation requires a caller-owned idempotency key of at most 64 characters. Reads are uncached; the seven terminal-setting and payment-method reads whose official schemas can materialize passcodes or acquirer credentials are marked sensitive-read. Auth is connection-owned, pagination follows provider links or documented offsets, and no financial resource is misrepresented as a work-entity Source.

Adyen Disputes v30 defense-reason retrieval and explicitly approval-gated accept, defend, document-supply, and document-delete operations. Generated from Adyen current official commit-pinned OpenAPI 3.1 source. Every mutation is grant-off, requires approval every run, and every admitted POST mutation requires a caller-owned idempotency key of at most 64 characters. Reads are uncached; the seven terminal-setting and payment-method reads whose official schemas can materialize passcodes or acquirer credentials are marked sensitive-read. Auth is connection-owned, pagination follows provider links or documented offsets, and no financial resource is misrepresented as a work-entity Source.

Adyen Management v3 company, merchant, store, user, API-credential metadata, and allowed-origin administration without secret issuance. Generated from Adyen current official commit-pinned OpenAPI 3.1 source. Every mutation is grant-off, requires approval every run, and every admitted POST mutation requires a caller-owned idempotency key of at most 64 characters. Reads are uncached; the seven terminal-setting and payment-method reads whose official schemas can materialize passcodes or acquirer credentials are marked sensitive-read. Auth is connection-owned, pagination follows provider links or documented offsets, and no financial resource is misrepresented as a work-entity Source.

Adyen Management v3 payment methods, payout settings, split configuration, donation campaigns, and webhook administration without HMAC-secret generation. Generated from Adyen current official commit-pinned OpenAPI 3.1 source. Every mutation is grant-off, requires approval every run, and every admitted POST mutation requires a caller-owned idempotency key of at most 64 characters. Reads are uncached; the seven terminal-setting and payment-method reads whose official schemas can materialize passcodes or acquirer credentials are marked sensitive-read. Auth is connection-owned, pagination follows provider links or documented offsets, and no financial resource is misrepresented as a work-entity Source.

Adyen Management v3 terminal inventory, orders, actions, settings, logos, shipping locations, and Android app and certificate administration. Generated from Adyen current official commit-pinned OpenAPI 3.1 source. Every mutation is grant-off, requires approval every run, and every admitted POST mutation requires a caller-owned idempotency key of at most 64 characters. Reads are uncached; the seven terminal-setting and payment-method reads whose official schemas can materialize passcodes or acquirer credentials are marked sensitive-read. Auth is connection-owned, pagination follows provider links or documented offsets, and no financial resource is misrepresented as a work-entity Source.

Adyen Transfers v4 transaction and transfer reads plus approval-gated transfer creation, approval, cancellation, returns, and cash outs. Generated from Adyen current official commit-pinned OpenAPI 3.1 source. Every mutation is grant-off, requires approval every run, and every admitted POST mutation requires a caller-owned idempotency key of at most 64 characters. Reads are uncached; the seven terminal-setting and payment-method reads whose official schemas can materialize passcodes or acquirer credentials are marked sensitive-read. Auth is connection-owned, pagination follows provider links or documented offsets, and no financial resource is misrepresented as a work-entity Source.

V3 deterministic file-encryption capability pack. By-value connector composition (service_kind=cli, no separate ingredient): the local age CLI encrypts one source file to one recipient via the file.encrypt_age catalog operation. This pack deliberately exposes encrypt-only recipient mode: no decrypt, no identity files, no passphrase prompts, no recipient files, and no arbitrary flags. Fixed-function and reproducible: the executor materializes the source file and owns the throwaway output directory, while age writes a fixed armored encrypted.age result captured as result.file_ref. Requires age on PATH (Debian/Ubuntu: apt install age; macOS: brew install age). Local and no-egress.

One-install Airbyte Cloud front door over six bounded capability packs and 30 non-chat, uncached, read-only workflows. It admits 89 of 92 official public operations across 48 paths: health; Applications and Embedded; jobs, sources, destinations, connections, streams, and tags; connector definitions; regions and dataplanes; and workspace, organization, user, permission, and group administration. The documentation redirect and OAuth callback are excluded as browser surfaces. The secret-bearing access-token endpoint is excluded from recipes and used only inside the trusted connection adapter, which supports Airbyte's short-lived OAuth2 client-credentials tokens. Health is connectionless; all other admitted operations use the selected encrypted Airbyte Application connection. All 35 admitted JSON bodies are required and sent verbatim, including the six whose OpenAPI omits requestBody.required. Seven documented limit/offset collections automatically request 100 records per page. Three definition collections expose response links without request continuation parameters and remain explicit single-page gaps. includeSecretCoordinates is fixed false. Client-secret and connector-configuration reads remain callable but are excluded from bundled rendering workflows. Reads are uncached and not approval-gated, every mutation requires approval, unsafe response integers remain exact strings, and provider failures surface without hidden retries. No pipeline or administration object is claimed as a task, note, or user-work project Source.

Airbyte Applications administration and Embedded organization, widget-token, and scoped-token capabilities. Generated from Airbyte's immutable platform commit c7d3fda1b07b… and hash-locked aggregate OpenAPI 3.1.0 snapshot (971570d4f6a6…). This leaf carries 7 of the suite's 89 admitted operations at https://api.airbyte.com/v1. Calls use an Airbyte Application client id and secret only inside the trusted connection adapter, which mints a short-lived bearer token at the fixed token endpoint. All 35 suite JSON mutations use bounded, required body_raw payloads; documented offset collections paginate automatically while three definition collections remain explicit single-page gaps because their requests expose no continuation parameter. includeSecretCoordinates is fixed false, unsafe response integers remain exact strings, reads are uncached and not approval-gated, and every mutation requires approval. No pipeline or administration object is misrepresented as a task, note, or user-work project Source.

Airbyte connector metadata plus declarative, source, and destination definition administration. Generated from Airbyte's immutable platform commit c7d3fda1b07b… and hash-locked aggregate OpenAPI 3.1.0 snapshot (971570d4f6a6…). This leaf carries 16 of the suite's 89 admitted operations at https://api.airbyte.com/v1. Calls use an Airbyte Application client id and secret only inside the trusted connection adapter, which mints a short-lived bearer token at the fixed token endpoint. All 35 suite JSON mutations use bounded, required body_raw payloads; documented offset collections paginate automatically while three definition collections remain explicit single-page gaps because their requests expose no continuation parameter. includeSecretCoordinates is fixed false, unsafe response integers remain exact strings, reads are uncached and not approval-gated, and every mutation requires approval. No pipeline or administration object is misrepresented as a task, note, or user-work project Source.

Airbyte Cloud region and dataplane deployment administration. Generated from Airbyte's immutable platform commit c7d3fda1b07b… and hash-locked aggregate OpenAPI 3.1.0 snapshot (971570d4f6a6…). This leaf carries 10 of the suite's 89 admitted operations at https://api.airbyte.com/v1. Calls use an Airbyte Application client id and secret only inside the trusted connection adapter, which mints a short-lived bearer token at the fixed token endpoint. All 35 suite JSON mutations use bounded, required body_raw payloads; documented offset collections paginate automatically while three definition collections remain explicit single-page gaps because their requests expose no continuation parameter. includeSecretCoordinates is fixed false, unsafe response integers remain exact strings, reads are uncached and not approval-gated, and every mutation requires approval. No pipeline or administration object is misrepresented as a task, note, or user-work project Source.

Airbyte workspaces, organizations, users, permissions, groups, memberships, and OAuth override administration. Generated from Airbyte's immutable platform commit c7d3fda1b07b… and hash-locked aggregate OpenAPI 3.1.0 snapshot (971570d4f6a6…). This leaf carries 27 of the suite's 89 admitted operations at https://api.airbyte.com/v1. Calls use an Airbyte Application client id and secret only inside the trusted connection adapter, which mints a short-lived bearer token at the fixed token endpoint. All 35 suite JSON mutations use bounded, required body_raw payloads; documented offset collections paginate automatically while three definition collections remain explicit single-page gaps because their requests expose no continuation parameter. includeSecretCoordinates is fixed false, unsafe response integers remain exact strings, reads are uncached and not approval-gated, and every mutation requires approval. No pipeline or administration object is misrepresented as a task, note, or user-work project Source.

Airbyte jobs, sources, destinations, connections, streams, and tags across the pipeline runtime. Generated from Airbyte's immutable platform commit c7d3fda1b07b… and hash-locked aggregate OpenAPI 3.1.0 snapshot (971570d4f6a6…). This leaf carries 28 of the suite's 89 admitted operations at https://api.airbyte.com/v1. Calls use an Airbyte Application client id and secret only inside the trusted connection adapter, which mints a short-lived bearer token at the fixed token endpoint. All 35 suite JSON mutations use bounded, required body_raw payloads; documented offset collections paginate automatically while three definition collections remain explicit single-page gaps because their requests expose no continuation parameter. includeSecretCoordinates is fixed false, unsafe response integers remain exact strings, reads are uncached and not approval-gated, and every mutation requires approval. No pipeline or administration object is misrepresented as a task, note, or user-work project Source.

Airbyte Cloud health checking, isolated from credential-bearing control-plane operations. Generated from Airbyte's immutable platform commit c7d3fda1b07b… and hash-locked aggregate OpenAPI 3.1.0 snapshot (971570d4f6a6…). This leaf carries 1 of the suite's 89 admitted operations at https://api.airbyte.com/v1. The health endpoint is connectionless because the official operation explicitly declares no authentication. All 35 suite JSON mutations use bounded, required body_raw payloads; documented offset collections paginate automatically while three definition collections remain explicit single-page gaps because their requests expose no continuation parameter. includeSecretCoordinates is fixed false, unsafe response integers remain exact strings, reads are uncached and not approval-gated, and every mutation requires approval. No pipeline or administration object is misrepresented as a task, note, or user-work project Source.

API capability pack for bounded Airtable operations against https://api.airtable.com only. The pack discovers accessible bases and table schemas, reads base access/collaborator details, reads one bounded page of records, saved-view queues, sorted record queues, one record, record comments, webhook delivery status, and webhook payloads, creates one record, patch-updates one record, and creates or updates one record comment in a selected base/table. Enroll an Airtable personal access token or OAuth access token connection as bearer auth; no credential is embedded in the manifest. Writes are approval-gated. The pack intentionally excludes schema mutations, record/comment deletes, destructive PUT updates, upserts, bulk record writes, attachment upload flows, webhook creation/deletion, notification toggles, automations, admin configuration, and arbitrary fetches.

One-install Aiven front door over 8 bounded domain packs and 18 non-chat, uncached, read-only workflows. It admits all 399 nondeprecated operations across 322 official paths and excludes exactly 65 provider-deprecated operations. Organizations, accounts, users, billing, projects, clouds, VPCs, services, integrations, Kafka, MirrorMaker, Flink, PostgreSQL, OpenSearch, ClickHouse, MySQL, and Thanos are covered. The vendor-hosted OpenAPI is mutable but generation fails closed unless its 1,821,442 bytes retain SHA-256 aedf71cf0f9d0e2587ae941a67adf563a14b2c5417697df77c6067f38d9067fe; the official API guide independently pins https://api.aiven.io/v1 and the exact Authorization: aivenv1 TOKEN format. Wire calls use the origin-only base plus /v1 paths, and openapi_source.path_alias strips that documented server prefix during proof. Four optional repeated query arrays omit item schemas and are omitted because the closed operation request-schema gate cannot express arrays; two string filters misuse numeric bounds, so those values are applied as string lengths. Three non-JSON downloads become private file_refs. Two exact pagination loops are automatic; two next-page strings whose cursor-vs-URL shape is unspecified stay explicitly manual. Twenty POST-shaped reports, lists, fetches, validations, compatibility checks, or analyses are classified as reads; twelve generic-looking updates with power-off, arbitrary SQL, credential rotation, maintenance, service-type, or deleting-tag authority are explicitly destructive. JSON bodies remain verbatim and unsafe response integers remain exact strings. Reads are uncached and not approval-gated; every mutation requires approval. No task, note, or project Source is claimed for infrastructure containers or runtime executions.

Aiven accounts, account events and projects, personal tokens, user profiles, authentication methods, and managed organization users. Generated from Aiven's hash-locked official OpenAPI 3.0.1 snapshot (aedf71cf0f9d…) and carries 46 of the suite's 399 nondeprecated operations. The mutable vendor URL must retain the reviewed byte length and SHA-256 before regeneration. Pick the Aiven connection whose Authorization header contains the complete aivenv1 token value for api.aiven.io. Wire paths carry /v1 while the documentary path alias strips that server prefix before proof. Four optional repeated query filters whose item schemas are absent are omitted because the closed request-schema gate cannot express arrays. JSON bodies remain verbatim, unsafe response integers remain exact strings, binary downloads become private file_refs, reads are uncached and not approval-gated, and every mutation requires approval. No infrastructure container or runtime execution is misrepresented as a task, note, or project Source.

Aiven billing groups, credits, events, invoices, invoice downloads, addresses, payment methods, and organization emissions. Generated from Aiven's hash-locked official OpenAPI 3.0.1 snapshot (aedf71cf0f9d…) and carries 28 of the suite's 399 nondeprecated operations. The mutable vendor URL must retain the reviewed byte length and SHA-256 before regeneration. Pick the Aiven connection whose Authorization header contains the complete aivenv1 token value for api.aiven.io. Wire paths carry /v1 while the documentary path alias strips that server prefix before proof. Four optional repeated query filters whose item schemas are absent are omitted because the closed request-schema gate cannot express arrays. JSON bodies remain verbatim, unsafe response integers remain exact strings, binary downloads become private file_refs, reads are uncached and not approval-gated, and every mutation requires approval. No infrastructure container or runtime execution is misrepresented as a task, note, or project Source.

Aiven PostgreSQL extensions and pools, OpenSearch indexes and snapshots, ClickHouse databases and queries, MySQL metadata, and Thanos storage. Generated from Aiven's hash-locked official OpenAPI 3.0.1 snapshot (aedf71cf0f9d…) and carries 52 of the suite's 399 nondeprecated operations. The mutable vendor URL must retain the reviewed byte length and SHA-256 before regeneration. Pick the Aiven connection whose Authorization header contains the complete aivenv1 token value for api.aiven.io. Wire paths carry /v1 while the documentary path alias strips that server prefix before proof. Four optional repeated query filters whose item schemas are absent are omitted because the closed request-schema gate cannot express arrays. JSON bodies remain verbatim, unsafe response integers remain exact strings, binary downloads become private file_refs, reads are uncached and not approval-gated, and every mutation requires approval. No infrastructure container or runtime execution is misrepresented as a task, note, or project Source.

Aiven Flink applications, versions, deployments, JAR applications, jobs, SQL statements, integrations, and cluster overview. Generated from Aiven's hash-locked official OpenAPI 3.0.1 snapshot (aedf71cf0f9d…) and carries 32 of the suite's 399 nondeprecated operations. The mutable vendor URL must retain the reviewed byte length and SHA-256 before regeneration. Pick the Aiven connection whose Authorization header contains the complete aivenv1 token value for api.aiven.io. Wire paths carry /v1 while the documentary path alias strips that server prefix before proof. Four optional repeated query filters whose item schemas are absent are omitted because the closed request-schema gate cannot express arrays. JSON bodies remain verbatim, unsafe response integers remain exact strings, binary downloads become private file_refs, reads are uncached and not approval-gated, and every mutation requires approval. No infrastructure container or runtime execution is misrepresented as a task, note, or project Source.