Marketplace

API capability pack for bounded Segment Public API v1 operations against https://api.segmentapis.com only, using the published Segment OpenAPI/SDK version 73.0.0. Enroll a Segment Public API token connection named segment as bearer auth; no credential is embedded in the manifest. The pack reads workspace identity, sources, destinations, warehouses, tracking plans, tracking-plan rules, labels, source schema settings, connected destinations/warehouses, audit events, event volume, API-call usage, and MTU usage. It supports approval-gated governance writes for creating/updating tracking plans, adding a source to a tracking plan, replacing/upserting tracking-plan rules, creating labels, and adding labels to a source. It intentionally excludes source/destination/warehouse creation or credential mutation, destination subscriptions, user/group/IAM administration, regulations and suppression APIs, write-key creation/removal, live plugins, selective sync writes, delete operations, EU endpoint switching, and arbitrary API passthrough.

Sell time-boxed access for a one-time price. A buyer pays once through a hosted Stripe Checkout Session and receives a single-use claim link for access that expires on its own - a day pass, a week of support, a season of a private feed. Three owner-attended recipes: the opener turns one accepted intake response into an order and its mode:payment checkout, the fulfilment proves the session is complete and paid, issues access stamped with the tier's own pass duration, and mails the claim link on your configured sender, and the closer recovers an order whose access issued but whose claim link could not be delivered. Create the pass tier first in Settings -> Seller (Create pass tier); the offer names which pass it sells through its fulfillment_config. Nothing here takes payment authority: every amount, session and payment is a fresh provider read, and Recued issues the access without ever touching the money.

Optional refund/dispute handler for subscription sellers who adjudicate reversals case by case rather than revoking automatically. When a Stripe charge is fully refunded (charge.refunded) or disputed (charge.dispute.created), it re-reads provider truth for the customer id and surfaces an in-app review notice naming that customer and the bound door — and changes nothing. You then decide whether to revoke that customer's access (Settings -> Seller). It rides the bounded Stripe for Sellers surface, never the full API front door, and takes no payment authority: every customer id is a fresh provider read, never the webhook payload. This is one of two install variants — install the revoke pack instead if you always close access when a charge is reversed.

Optional refund/dispute handler for subscription sellers who revoke access when a charge is reversed. When a Stripe charge is fully refunded (charge.refunded) or disputed (charge.dispute.created), it re-reads provider truth for the customer id and closes that customer's access on the bound door with a supported close reason (refunded / dispute). Whether the close is immediate or enters a grace window is the seller's own status policy (Settings -> Seller), not this pack. It rides the bounded Stripe for Sellers surface, never the full API front door, and takes no payment authority: every customer id is a fresh provider read, never the webhook payload. This is one of two install variants — install the flag-only pack instead if you adjudicate refunds and disputes case by case rather than revoking automatically.

The bounded Stripe surface the Recued seller substrate needs, and nothing else. Selling through Stripe takes ten operations; the Full Stripe API front door carries 611 across thirteen packs, and granting that to run a checkout is a consent surface nobody reads. Every operation here is hand-authored to one job: open one hosted Checkout Session — one-time over an inlined price, or recurring over a real recurring Price — with explicit Recued workflow correlation, and re-read Session, payment, refund, dispute, subscription, invoice, entitlement and invoice-payment truth at the provider so an order only ever moves on evidence. The reads never ask, because the verified-event flows that depend on them run unattended. Install the Full Stripe API alongside this if you also want the rest of Stripe; the two are independent, and a same-named read on each is a distinct operation id, so grants and consent never collide.

The verified-event half of subscription access: one install covers the whole billing lifecycle, so a seller who has enrolled Stripe does not have to assemble it lane by lane. A subscription checkout completion reaches paid only through core.seller.order.confirm-payment after a fresh Session read, and only once a fresh invoice-payment read proves which PaymentIntent settled it — a subscription-mode Session exposes none. Renewal invoices are the second half: each paid subscription_cycle invoice becomes its own order for that billing period, confirmed only through core.seller.order.confirm-renewal-payment after fresh invoice, subscription, and invoice-payment reads, and the customer's access is extended from the order's own tier snapshot. billing_reason is the seam — subscription_create belongs to the checkout observer, subscription_cycle to the renewal flow, so the two never settle the same payment twice. Four further lanes keep access converged with the provider once it is selling: a failed invoice reports the subscription's confirmed status, a deleted subscription closes access, and a plan or entitlement change swaps the customer onto the tier their entitlements now say they hold. None of them decides what a status costs a customer — each reports provider-confirmed state and your status policy (Settings -> Seller) decides grace, immediate close, or keep active. The housekeeping reconciler remains the authority and converges all of it on its own sweep; these lanes only remove the wait. The order row is the single lifecycle record (Settings -> Seller -> Orders). Event snapshot fields are never transition authority. This pack sells nothing on its own: it observes payment for orders another flow opened, and it is deliberately independent of document fulfilment. It rides the bounded Stripe for Sellers surface, not the full API front door.

Optional self-healing sweep for subscription sellers. When a server is offline past Stripe's retry window, an access grant a webhook would have issued is missed and stays missing until something re-derives it. This sweep lists the seller's active Stripe subscriptions, recovers each one's order by the recued_workflow_key it carries, and issues the customer's access on the bound door where the order names a tier - idempotently, so it is safe to run over every subscription and converges on repeat. It rides the bounded Stripe for Sellers surface, never the full API front door, and takes no payment authority: every subscription, customer, and period is a fresh provider read. Run it MANUALLY from Settings -> Seller. It is the reset button at the bottom of the recovery ladder - the webhook is the first path, the housekeeping reconciler pulls per local order on its idle sweep, and this exists for what both missed. A reset is meant to be exhaustive, so it lists every active subscription with no cap; that is correct when you press it deliberately and is the reason not to put it on a schedule. Install it for the door the recovered subscriptions belong to.

V3 static-analysis scan capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local semgrep CLI ingredient exposes bounded project operations for readiness and SAST scanning. Scans run from an explicit project directory cwd supplied at execution time, scan one trusted source directory with the fixed Semgrep Registry p/default ruleset, and return Semgrep JSON findings via the code.sast_scan catalog operation. Fixed-function and bounded: scan command only, JSON stdout, metrics disabled, version check disabled, OSS engine only, no autofix, no finding-based exit failure, no caller-supplied config/rule/pattern, no remote repository clone, no CI/login/publish/LSP/MCP/server command, no Pro engine, no secrets validation, no output-file write, no SARIF/GitLab/JUnit sidecar, no arbitrary semgrep flags, and no shell wrapper. Approval is ask because fetching Registry rules contacts semgrep.dev. Requires semgrep on PATH. Network egress to Semgrep Registry for the fixed ruleset.

API capability pack for bounded Twilio SendGrid calls against https://api.sendgrid.com only. The pack can send one transactional email, read account/profile/credit state, retrieve global stats, search/read Email Activity messages, inspect bounces/blocks/invalid emails/spam reports/global suppressions, read unsubscribe groups and group suppressions, search/read transactional templates, and inspect one template version. Enroll a SendGrid API-key connection as a bearer token; no credential is embedded in the manifest. Email sending and suppression changes are write-tier and approval-gated. The pack intentionally excludes batch sending, all-suppression purges, template create/edit/delete/activation, marketing campaign, webhook, subuser/admin, API-key, IP, and account-settings mutation surfaces.

One-install Sentry API front door over four bounded feature packs and four existing workflows. It admits 199 of 221 current public operations from Sentry's hash-pinned OpenAPI 3.0.3 document. The compatibility root preserves all 20 prior operation IDs, routes, argument keys, and approval contracts while dependencies add 179 operations. Exact fail-closed exclusions cover 18 credential-bearing routes, two deprecated routes, and two multipart uploads. The pack remains origin-pinned to the prior https://us.sentry.io connection contract; Sentry's regional host selection remains connection enrollment scope rather than an operation argument. New JSON mutations use complete bounded body_raw documents, new reads are uncached, every new mutation requires approval, and unsafe JSON integers remain exact strings. The entity audit removes two stale fields no longer declared by the current public schema.

Sentry cron monitors, detectors, workflows, and spike-protection notification actions. This bounded leaf carries 29 hash-pinned public Sentry API operations. Every mutation requires approval, reads are uncached, JSON responses preserve unsafe integers, and JSON mutations use complete bounded body_raw documents. Credential-bearing responses, credential-carrying requests, deprecated routes, and multipart uploads are excluded fail-closed.

Sentry dashboards, Discover, environments, events, Explore, mobile-build analysis, profiling, replays, Seer, and snapshot operations. This bounded leaf carries 59 hash-pinned public Sentry API operations. Every mutation requires approval, reads are uncached, JSON responses preserve unsafe integers, and JSON mutations use complete bounded body_raw documents. Credential-bearing responses, credential-carrying requests, deprecated routes, and multipart uploads are excluded fail-closed.

Workflow pack that closes the loop between exception-scoped Sentry issues and owner-approved Linear follow-up work. It depends on the Sentry and Linear capability packs, detects one unhandled matching Sentry issue at a time, writes a data.shared proposal, notifies the owner, provides a manual action recipe that either creates the Linear issue and links it back to the Sentry issue or dismisses the proposal, and watches created Linear issues until they reach a terminal state. It does not replace Sentry alerts, Sentry ownership rules, Sentry's native issue-tracker integrations, Sentry alert ticket creation, or Linear triage automation; use it only when the normal native path is unavailable, intentionally bypassed, or missing Recued-visible closure state.

Sentry organizations, members, teams, SCIM, external users and teams, integrations, and integration-platform operations. This bounded leaf carries 57 hash-pinned public Sentry API operations. Every mutation requires approval, reads are uncached, JSON responses preserve unsafe integers, and JSON mutations use complete bounded body_raw documents. Credential-bearing responses, credential-carrying requests, deprecated routes, and multipart uploads are excluded fail-closed.

Sentry project configuration, release metadata, deploys, commits, debug files, ownership, repositories, teams, users, and safely bounded destructive operations. This bounded leaf carries 34 hash-pinned public Sentry API operations. Every mutation requires approval, reads are uncached, JSON responses preserve unsafe integers, and JSON mutations use complete bounded body_raw documents. Credential-bearing responses, credential-carrying requests, deprecated routes, and multipart uploads are excluded fail-closed.

API capability pack for bounded ServiceNow Table API operations. Enroll a servicenow API connection with base_url set to the instance API root, for example https://example.service-now.com/api/now, and authenticate with a least-privilege integration user or OAuth token that has table ACL access for the installed operations. The pack reads incidents, change requests, problems, tasks, users, and CMDB configuration items, and supports approval-gated incident creation, incident assignment/update/resolution, and change request creation/update. It bundles a scheduled incident triage digest, an AI-assisted incident brief, and approval-gated intake, assignment, resolution, and change workflows. The pack intentionally excludes arbitrary table access, record deletion, import sets, attachments, catalog ordering, knowledge mutation, CMDB mutation, user/admin mutation, scripted REST APIs, workflow execution, impersonation, system tables beyond sys_user reads, and arbitrary API passthrough.

V3 deterministic 7z archive capability pack. By-value connector composition (service_kind=cli, no separate ingredient): the local 7z CLI lists a trusted local archive path and extracts one requested archive entry via archive.list and archive.extract_entry catalog operations. Fixed-function and reproducible: extraction materializes the source archive and writes only to an engine-managed output directory, while listing is path-based text output. Requires 7z on PATH (Debian/Ubuntu: apt install 7zip). Local and no-egress.

API capability pack for bounded SharePoint site, list, and document-library operations through Microsoft Graph at https://graph.microsoft.com/v1.0 only. Searches and reads sites, lists root site collections, site lists, document-library drives, list columns/content types, list items with fields, list item versions/activity, document-library search/delta results, drive item metadata, versions, permissions, thumbnails, and activity, plus approval-gated daily document-library organization actions: create folders, rename drive items, move drive items within a drive, and asynchronously copy drive items. File upload/download/content reads, delete/trash, sharing-link creation, permission mutation, list-item update/delete, conflict-behavior tuning, and arbitrary Graph paths are intentionally not exposed. Enroll a Microsoft Graph OAuth access token connection as bearer auth; no credential is embedded in the manifest. Write operations are approval-gated.

One-install Procore front door over 40 bounded domain packs and 40 non-chat, uncached, read-only operating workflows. It admits 2805 of 2832 public operations from 610 current official OpenAPI resource documents across project management, financials, resource management, preconstruction, company administration, core projects/directory/documents/workflows, webhooks, and reports. The explicit exclusions are four OAuth/token lifecycle routes, two support-PIN routes, one BIM mint-token route, twelve multipart-only calls that the current REST adapter cannot faithfully encode, and eight beta Document Management v2 routes deferred for curated admission. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin and supply Procore-Company-Id where declared. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, JSON responses preserve unsafe integers, and every generated request stays on the fixed documented method/path. No operational mutation is bundled into a workflow and no task, note, or project Source is claimed before live field-path verification.

Company and project checklist templates, response sets, evidence configuration, item reference, inspector, and inspection-type operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 63 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Checklist, inspection schedule, item, section, comment, attachment, signature, response, and reinspections operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 87 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Material, requirement, purchase-order, label, and recycle-bin operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 74 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Material transfer, inter-project transfer, adjustment, and defect operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 82 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Material shipment, receipt, and issuing operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 77 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Meeting, agenda, email, form, calendar, schedule import/export, activity, and lookahead operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 61 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Webhook resource, hook, trigger, delivery, app installation/configuration, company-zone, user-info, and field-production report operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 48 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Prime-contract, contract, owner-invoice, line-item, payment, and export operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 63 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Project, portfolio, company and project document, folder, file, and direct-upload operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 96 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

RFI, punch-item, observation, response, assignment, filter, template, and export operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 98 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

People, assignments, requests, projects, time off, tags, titles, wages, reports, and resource-planning telematics operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 77 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Specification, spec-section, revision, schedule task, calendar, resource, lookahead, and legacy schedule operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 97 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Submittal, workflow, response, revision, attachment, distribution, status, type, and export operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 57 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Work breakdown structure, cost-code, cost-type, segment, flat-code, and sync operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 71 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

Workflow templates, presets, instances, history, assignments, responses, and flow-control operations. Generated from a point-in-time SHA-256 inventory of 610 official Procore OpenAPI resource documents retrieved 2026-07-20. This pack carries 51 of the suite's 2805 admitted operations. The vendor publishes the resources as separate moving documents, so this composition deliberately carries no misleading single-document OpenAPI pin. Enroll one production OAuth authorization-code connection for the fixed https://api.procore.com origin. Supply the documented Procore-Company-Id header when an operation requires it. Reads are uncached and are marked sensitive-read where the response can carry directory, financial, or personnel detail; every mutation requires approval, beta endpoints are labeled, and unsafe JSON response integers are preserved as strings. OAuth/token lifecycle, support PINs, BIM mint tokens, multipart-only requests, and the deferred beta Document Management v2 surface are excluded. No task, note, or project Source is claimed without the guide-mandated live field-path verification.

One-install managed Pulumi Cloud front door over 14 bounded domain packs and 15 non-chat, ungated read workflows. It inventories all 618 official operations across 471 paths, admits all 548 nondeprecated operations supported by the current REST runtime, and records exactly 64 provider-deprecated, five HEAD, and one SSE exclusion. The official OpenAPI is byte/hash locked but omits servers and authentication; Pulumi's equally pinned first-party REST guide supplies the fixed https://api.pulumi.com origin, complete "Authorization: token <access-token>" header contract, and application/vnd.pulumi+8 media version. Self-hosted Pulumi Cloud is deliberately not weakened into a caller-controlled origin and should receive a separate exact-host family. All 196 documented bodies are required bounded verbatim JSON or YAML because the generator omits requestBody.required systematically. JSON integers remain lossless, tar output is file_ref-isolated, proven pagination loops are automatic, and every ambiguous loop is named as single-response-only. Four Registry routes with no documented 2xx remain callable without an invented success schema. Reads are uncached and not approval-gated, every mutation requires approval, and provider failures receive no hidden retry. Infrastructure control-plane records are not claimed as user-work Sources.

Pulumi user account state, access tokens, AI and Neo agents, claims, tasks, usage caps, and AWS/Azure/GCP cloud-setup flows. This leaf carries 44 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi Deployments, schedules, drift runs, logs, settings, and private deployment-runner agent pools. This leaf carries 43 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi ESC environment discovery, definitions, revisions, referrers, tags, providers, rotators, and read/open/decrypt result retrieval. This leaf carries 33 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi ESC environment creation, updates, cloning, imports, access, tags, rotation, open sessions, encryption, and deletion. This leaf carries 38 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi Insights accounts, cloud inventory scans, discovered stacks, resources, versions, edges, logs, and trial state. This leaf carries 45 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi organization webhooks, services, templates, stack restore and transfer support, and registry/package usage surfaces. This leaf carries 29 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi change gates and requests, project settings, resource search and export, stack transfer support, metadata, and usage summaries. This leaf carries 29 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi organization audit logs, policy results, policy groups, policy packs, and customer-managed encryption keys. This leaf carries 39 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi organization membership, teams, invites, roles, tokens, SAML, OIDC, and authentication-policy administration. This leaf carries 54 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi Registry packages, templates, policy packs, Terraform modules, service capabilities, CLI version, OAuth exchange, and OpenAPI discovery. This leaf carries 31 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi stack activity, updates, previews, hooks, collaboration, references, notifications, teams, and policy associations. This leaf carries 31 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi destroy, preview, refresh, and update sessions including status, events, leases, checkpoints, journals, logs, cancellation, and completion. This leaf carries 53 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.

Pulumi stack lifecycle, configuration, encryption/decryption, resources, state import/export, tags, metadata, ownership, and transfer. This leaf carries 30 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.