@epilot/cli 0.1.173 → 0.1.175

package/definitions/integration-toolkit.json

@@ -2,7 +2,7 @@
   "openapi": "3.0.3",
   "info": {
     "title": "Integration Toolkit API",
-    "version": "1.33.0",
+    "version": "1.33.1",
     "description": "API for integrating with external systems in a standardised way."
   },
   "tags": [
@@ -49,6 +49,7 @@
     "/v1/erp/tracking/acknowledgement": {
       "post": {
         "operationId": "acknowledgeTracking",
+        "x-epilot-permissions": [],
         "summary": "acknowledgeTracking",
         "description": "Acknowledges an ERP tracking record by removing it from the tracking table, requires public authentication",
         "tags": [
@@ -106,6 +107,11 @@
     "/v1/erp/trigger": {
       "post": {
         "operationId": "triggerErp",
+        "x-epilot-permissions": [
+          {
+            "action": "entity:view"
+          }
+        ],
         "summary": "triggerErp",
         "description": "Triggers the ERP integration process",
         "tags": [
@@ -142,6 +148,7 @@
       "post": {
         "deprecated": true,
         "operationId": "processErpUpdatesEvents",
+        "x-epilot-permissions": [],
         "summary": "processErpUpdatesEvents",
         "description": "Handles updates from ERP systems and tracks them appropriately",
         "tags": [
@@ -237,6 +244,7 @@
       "post": {
         "deprecated": true,
         "operationId": "processErpUpdatesEventsV2",
+        "x-epilot-permissions": [],
         "summary": "processErpUpdatesEventsV2",
         "description": "Handles updates from ERP systems using integration_id directly.\nThis is the v2 version that simplifies the API by accepting integration_id\ninstead of app_id and component_id.\n",
         "tags": [
@@ -295,6 +303,7 @@
     "/v3/erp/updates/events": {
       "post": {
         "operationId": "processErpUpdatesEventsV3",
+        "x-epilot-permissions": [],
         "summary": "processErpUpdatesEventsV3",
         "description": "Handles updates from ERP systems using integration_id directly.\nThis is the v3 version that removes the unused event_type field and renames object_type to event_name\nto align with the integration UI naming.\n",
         "tags": [
@@ -351,6 +360,7 @@
     "/v2/erp/updates/mapping_simulation": {
       "post": {
         "operationId": "simulateMappingV2",
+        "x-epilot-permissions": [],
         "summary": "simulateMappingV2",
         "description": "Test v2.0 mapping configuration by transforming a payload using the provided mapping rules without persisting data.\n\nThis endpoint accepts the same configuration format that is stored in the integration use case resource,\nmaking it easier to test configurations before saving them to a use case.\n\nSee documentation at /docs/MAPPING_V2.md for detailed v2.0 format specification.\n",
         "tags": [
@@ -622,6 +632,7 @@
     "/v1/erp/updates/direct_simulation": {
       "post": {
         "operationId": "simulateDirect",
+        "x-epilot-permissions": [],
         "summary": "simulateDirect",
         "description": "Dry run for direct-mode payloads: validates a `DirectPayload` against a `direct: true`\nuse case configuration and previews the internal entity and meter reading updates the\npipeline would apply — without persisting anything.\n\nUnlike the ingest endpoint, validation does not stop at the first problem: ALL issues\nacross all operations are collected into `errors`, each carrying the index of the\noperation it refers to. When the payload is valid, the response additionally contains\nthe translated update previews plus non-blocking `warnings` (for example unique-id\nfields that are not defined in the target entity schema, or a failed server-side\nunique-id type derivation).\n\nUse this endpoint while designing a direct integration, before sending events to\n`POST /v3/erp/updates/events`. See documentation at /docs/DIRECT_MODE.md.\n",
         "tags": [
@@ -783,6 +794,7 @@
     "/v1/erp/updates/mapping_simulation": {
       "post": {
         "operationId": "simulateMapping",
+        "x-epilot-permissions": [],
         "summary": "simulateMapping",
         "description": "Test mapping configuration by transforming a payload using the provided mapping rules without persisting data.\n\nSupports both v1.0 (object-based) and v2.0 (event-based) mapping formats.\nSee documentation at /docs/MAPPING_V2.md for detailed v2.0 format specification.\n",
         "tags": [
@@ -1116,6 +1128,11 @@
     "/v1/integrations": {
       "get": {
         "operationId": "listIntegrations",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "listIntegrations",
         "description": "Retrieve all integrations for the authenticated organization",
         "tags": [
@@ -1153,6 +1170,11 @@
       },
       "post": {
         "operationId": "createIntegration",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "createIntegration",
         "description": "Create a new integration configuration",
         "tags": [
@@ -1194,6 +1216,11 @@
     "/v1/integrations/{integrationId}": {
       "get": {
         "operationId": "getIntegration",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "getIntegration",
         "description": "Retrieve a specific integration by its ID",
         "tags": [
@@ -1235,6 +1262,11 @@
       },
       "put": {
         "operationId": "updateIntegration",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "updateIntegration",
         "description": "Update an existing integration configuration",
         "tags": [
@@ -1289,6 +1321,11 @@
       },
       "delete": {
         "operationId": "deleteIntegration",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "deleteIntegration",
         "description": "Delete an integration and all its use cases",
         "tags": [
@@ -1337,6 +1374,11 @@
     "/v1/integrations/{integrationId}/events": {
       "post": {
         "operationId": "queryEvents",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "queryEvents",
         "description": "Query events for a specific integration",
         "tags": [
@@ -1386,6 +1428,11 @@
     "/v1/integrations/{integrationId}/events/replay": {
       "post": {
         "operationId": "replayEvents",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "replayEvents",
         "description": "Replay one or more events for a specific integration. Events will be re-processed with their original payloads but with a new correlation ID for traceability.",
         "tags": [
@@ -1435,6 +1482,11 @@
     "/v1/integrations/{integrationId}/use-cases": {
       "get": {
         "operationId": "listUseCases",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "listUseCases",
         "description": "Retrieve all use cases for a specific integration",
         "tags": [
@@ -1484,6 +1536,11 @@
       },
       "post": {
         "operationId": "createUseCase",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "createUseCase",
         "description": "Create a new use case for an integration",
         "tags": [
@@ -1540,6 +1597,11 @@
     "/v1/integrations/{integrationId}/use-cases/{useCaseId}": {
       "get": {
         "operationId": "getUseCase",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "getUseCase",
         "description": "Retrieve a specific use case by its ID",
         "tags": [
@@ -1591,6 +1653,11 @@
       },
       "put": {
         "operationId": "updateUseCase",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "updateUseCase",
         "description": "Update an existing use case configuration",
         "tags": [
@@ -1655,6 +1722,11 @@
       },
       "delete": {
         "operationId": "deleteUseCase",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "deleteUseCase",
         "description": "Delete a use case from an integration",
         "tags": [
@@ -1713,6 +1785,11 @@
     "/v1/integrations/{integrationId}/use-cases/{useCaseId}/history": {
       "get": {
         "operationId": "listUseCaseHistory",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "listUseCaseHistory",
         "description": "Retrieve historical versions of a use case's configuration.\nHistory entries are returned in reverse chronological order (newest first).\nUse the 'cursor' parameter for pagination to fetch additional entries.\n",
         "tags": [
@@ -1792,6 +1869,11 @@
     "/v1/integrations/{integrationId}/documentation": {
       "get": {
         "operationId": "listDocumentationPages",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "listDocumentationPages",
         "description": "Retrieve all documentation pages of an integration, without their markdown content.\nAn integration has at most one general page plus at most one page per use case.\nThe page id is 'general' for the integration-wide page, otherwise the use case ID.\n",
         "tags": [
@@ -1846,6 +1928,11 @@
     "/v1/integrations/{integrationId}/documentation/{docId}": {
       "get": {
         "operationId": "getDocumentationPage",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "getDocumentationPage",
         "description": "Retrieve a single documentation page including its markdown content",
         "tags": [
@@ -1897,6 +1984,11 @@
       },
       "put": {
         "operationId": "upsertDocumentationPage",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "upsertDocumentationPage",
         "description": "Create or update the documentation page identified by docId.\nUpsert semantics enforce the invariant of one general page per\nintegration and one page per use case. For use case pages the\nuse case must exist.\n",
         "tags": [
@@ -1964,6 +2056,11 @@
       },
       "delete": {
         "operationId": "deleteDocumentationPage",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "deleteDocumentationPage",
         "description": "Delete a documentation page",
         "tags": [
@@ -2025,6 +2122,11 @@
     "/v2/integrations": {
       "get": {
         "operationId": "listIntegrationsV2",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "listIntegrationsV2",
         "description": "Retrieve all integrations with embedded use cases for the authenticated organization",
         "tags": [
@@ -2062,6 +2164,11 @@
       },
       "post": {
         "operationId": "createIntegrationV2",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "createIntegrationV2",
         "description": "Create a new integration with embedded use cases.\n",
         "tags": [
@@ -2103,6 +2210,11 @@
     "/v2/integrations/{integrationId}": {
       "get": {
         "operationId": "getIntegrationV2",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "getIntegrationV2",
         "description": "Retrieve a specific integration with all its embedded use cases",
         "tags": [
@@ -2144,6 +2256,11 @@
       },
       "put": {
         "operationId": "updateIntegrationV2",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "updateIntegrationV2",
         "description": "Update an existing integration with embedded use cases.\nThe integration must already exist.\nUse cases are updated declaratively:\n- Use cases in the request with matching IDs are updated\n- Use cases in the request without matching IDs are created\n- Existing use cases not in the request are deleted\n",
         "tags": [
@@ -2198,6 +2315,11 @@
       },
       "delete": {
         "operationId": "deleteIntegrationV2",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "deleteIntegrationV2",
         "description": "Delete an integration and all its use cases",
         "tags": [
@@ -2246,6 +2368,11 @@
     "/v2/integrations/{integrationId}/notifications/history": {
       "get": {
         "operationId": "listNotificationHistory",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "listNotificationHistory",
         "description": "Returns the cursor-paginated, newest-first notification history for an\nintegration (every real notification decision — both fired and suppressed).\nRequires the `integration:view` permission on the integration's organization.\n",
         "tags": [
@@ -2329,6 +2456,11 @@
     "/v2/integrations/{integrationId}/notifications/test": {
       "post": {
         "operationId": "testSendNotification",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "testSendNotification",
         "description": "Renders and sends ONE representative notification of the requested kind/type to\nthe CALLING USER ONLY (never any other recipient), so an operator can preview how\na notification looks. A test send does NOT write to the notification history.\nRequires the `integration:manage` permission on the integration's organization.\n",
         "tags": [
@@ -2403,6 +2535,11 @@
     "/v2/integrations/{integrationId}/notifications/status": {
       "get": {
         "operationId": "getNotificationStatus",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "getNotificationStatus",
         "description": "Returns the live per-rule alert state and (for 'auto' rules) the current\nhour-of-week baseline band for an integration's notification monitoring.\nReflects the latest 5-minute sweep — near-real-time, not live.\nRequires the `integration:view` permission on the integration's organization.\n",
         "tags": [
@@ -2469,6 +2606,7 @@
     "/v2/integrations/{integrationId}/use-cases/{useCaseId}/secure-proxy-whitelist": {
       "get": {
         "operationId": "getSecureProxyWhitelist",
+        "x-epilot-permissions": [],
         "summary": "getSecureProxyWhitelist",
         "description": "Returns the current allowed_domains, allowed_ips, and vpc_mode for a secure_proxy use case.\nStaff-only — gated by internal-auth issuer AND admin-portal Cognito user pool membership.\nRejects Login-As tokens.\n",
         "tags": [
@@ -2529,6 +2667,7 @@
       },
       "put": {
         "operationId": "updateSecureProxyWhitelist",
+        "x-epilot-permissions": [],
         "summary": "updateSecureProxyWhitelist",
         "description": "Replaces allowed_domains and/or allowed_ips on a secure_proxy use case.\nAt least one of the two fields is required. Validation mirrors the CLI's\n`validateDomainPatterns` / `validateCidrs`. Writes a USECASE_HISTORY row\nwith the admin user's email as `changed_by`.\n\nUpdate semantics per field:\n  - **omitted** — field is not modified; the stored value is preserved.\n  - **non-empty array** — the stored value is replaced with the supplied list.\n  - **empty array (`[]`)** — the list is cleared (stored as `[]`). This is\n    the canonical way to remove all entries. `null` is not accepted.\n\nStaff-only — same auth gates as GET.\n",
         "tags": [
@@ -2601,6 +2740,7 @@
     "/v2/integrations/{integrationId}/use-cases/{useCaseId}/secure-proxy-whitelist/history": {
       "get": {
         "operationId": "listSecureProxyWhitelistHistory",
+        "x-epilot-permissions": [],
         "summary": "listSecureProxyWhitelistHistory",
         "description": "Returns the most recent USECASE_HISTORY entries for a secure_proxy use case,\nin reverse chronological order (newest first). Each entry includes the\nactor email (`changed_by`), the ISO-8601 timestamp (`history_created_at`),\nthe `change_description` (free-text action), and the full `configuration`\nsnapshot — from which UI-08 computes a before/after diff between consecutive\nentries.\n\nStaff-only — gated by internal-auth issuer AND admin-portal Cognito user pool\nmembership. Rejects Login-As tokens (same auth gate as the GET / PUT\nsecure-proxy-whitelist operations).\n\nThin wrapper over the service-layer `listUseCaseHistory` that powers\n`GET /v1/integrations/{integrationId}/use-cases/{useCaseId}/history` — the\nseparate path exists because the /v1 variant is tenant-gated and admin-portal\ninternal-auth tokens do not carry tenant permissions.\n",
         "tags": [
@@ -2690,6 +2830,11 @@
     "/v1/integrations/{integrationId}/app-mapping": {
       "put": {
         "operationId": "setIntegrationAppMapping",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "setIntegrationAppMapping",
         "description": "Creates or updates a mapping from an app/component to an integration.\nThis allows ERP updates sent via app_id and component_id to be associated\nwith a specific integration configuration.\n",
         "tags": [
@@ -2754,6 +2899,11 @@
       },
       "delete": {
         "operationId": "deleteIntegrationAppMapping",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "deleteIntegrationAppMapping",
         "description": "Removes a mapping from an app/component to an integration.\n",
         "tags": [
@@ -2815,6 +2965,7 @@
     "/v1/integrations/{integrationId}/monitoring/inbound-events": {
       "post": {
         "operationId": "queryInboundMonitoringEvents",
+        "x-epilot-permissions": [],
         "summary": "queryInboundMonitoringEvents",
         "description": "Query inbound monitoring events for a specific integration.\nReturns detailed information about inbound sync events from ERP systems,\nincluding success rates, error breakdowns, and processing metrics.\n",
         "tags": [
@@ -2865,6 +3016,7 @@
     "/v1/integrations/{integrationId}/monitoring/stats": {
       "post": {
         "operationId": "getMonitoringStats",
+        "x-epilot-permissions": [],
         "summary": "getMonitoringStats",
         "description": "Get aggregated statistics for both inbound and outbound monitoring events for a specific integration.\nReturns summary metrics for inbound (ERP sync) and outbound (webhook delivery) events,\nincluding success/error counts and optional breakdowns.\n",
         "tags": [
@@ -2915,6 +3067,7 @@
     "/v1/integrations/{integrationId}/monitoring/timeseries": {
       "post": {
         "operationId": "getMonitoringTimeSeries",
+        "x-epilot-permissions": [],
         "summary": "getMonitoringTimeSeries",
         "description": "Get time-series aggregated event counts for monitoring charts.\nReturns pre-bucketed counts at configurable intervals for both inbound and outbound events.\nMaximum of 200 buckets per request. Returns 400 if the time range and interval would exceed this limit.\n",
         "tags": [
@@ -2965,6 +3118,7 @@
     "/v1/integrations/{integrationId}/outbound-status": {
       "get": {
         "operationId": "getOutboundStatus",
+        "x-epilot-permissions": [],
         "summary": "getOutboundStatus",
         "description": "Get the status of all outbound use cases for a specific integration.\nReturns conflict information when events or webhooks are disabled but the use case is enabled.\n",
         "tags": [
@@ -3008,6 +3162,7 @@
     "/v1/integrations/entities/{entityId}/sync-status": {
       "get": {
         "operationId": "getEntitySyncStatus",
+        "x-epilot-permissions": [],
         "summary": "getEntitySyncStatus",
         "description": "Get the inbound ERP sync status of an entity: when each integration last\nsynchronized (checked) the entity against the ERP, and when it last\nactually changed it. `last_synced_at` also advances on no-op checks —\nevents that were received and evaluated but changed nothing — which by\ndesign leave no trace on the entity itself (no activity feed entry, no\n`_updated_at` bump). Use it to tell whether an entity is up to date with\nthe ERP. Returns an empty list for entities no inbound use case has\nprocessed. Org-scoped via the caller's token.\n\nDeprecated alias: `GET /v1/entities/{entityId}/sync-status` is still\nserved (rewritten to this path in the API handler) but will be removed —\nmigrate callers to this path.\n",
         "tags": [
@@ -3061,6 +3216,12 @@
     "/v1/integrations/{integrationId}/outbound/messages/poll": {
       "post": {
         "operationId": "pollOutboundMessages",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:consume",
+            "resource": "integration:{integrationId}"
+          }
+        ],
         "summary": "pollOutboundMessages",
         "description": "Poll outbound messages for an integration's poll-mode use cases.\nTakes a lease on the head-of-line batch of the integration's FIFO stream:\nthe returned messages stay invisible to subsequent polls until they are\nacknowledged or the visibility timeout elapses. POST because taking a\nlease mutates server state — auto-retrying middleware must not burn\nleases. One in-flight batch per stream: while a lease is active (or\nanother poll wins the race), the response is an empty batch\n(`messages: []`), not an error. Requires the `integration:consume` grant.\n",
         "tags": [
@@ -3125,6 +3286,12 @@
     "/v1/integrations/{integrationId}/outbound/messages/ack": {
       "post": {
         "operationId": "ackOutboundMessages",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:consume",
+            "resource": "integration:{integrationId}"
+          }
+        ],
         "summary": "ackOutboundMessages",
         "description": "Acknowledge polled outbound messages. Acks are validated against the\nactive lease and committed as a prefix-contiguous cursor advance:\nmessages must be acknowledged in stream order. Out-of-order acks past\nthe first gap are rejected per id (`out_of_order`), acks with an\noutdated lease token are rejected (`stale_lease`), and unknown ids are\nrejected (`not_found`). Acknowledged messages are never delivered\nagain. Requires the `integration:consume` grant.\n",
         "tags": [
@@ -3189,6 +3356,12 @@
     "/v1/integrations/{integrationId}/outbound/messages/dlq": {
       "get": {
         "operationId": "listOutboundDlqMessages",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage",
+            "resource": "integration:{integrationId}"
+          }
+        ],
         "summary": "listOutboundDlqMessages",
         "description": "List an integration's dead-lettered outbound queue messages\n(poison_policy enforcement and operator skips move messages here).\nOperator endpoint — requires the `integration:manage` grant. Message\npayloads are NOT included in listings: entries are keyed by the\nopaque message id and carry delivery metadata only. Paginated via an\nopaque `next_token`.\n",
         "tags": [
@@ -3264,6 +3437,12 @@
     "/v1/integrations/{integrationId}/outbound/messages/dlq/redrive": {
       "post": {
         "operationId": "redriveOutboundDlqMessages",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage",
+            "resource": "integration:{integrationId}"
+          }
+        ],
         "summary": "redriveOutboundDlqMessages",
         "description": "Redrive selected dead-lettered messages back into the live stream.\nOperator endpoint — requires the `integration:manage` grant.\nA redriven message is re-enqueued at the tail with a new id and\nsequence — it is delivered out of its original per-entity order (the\nstream has moved on); this is inherent to redrive and matches SQS DLQ\nsemantics. The redriven copy starts with zero delivery attempts and a\nfresh retention window; the original DLQ entry is removed. Per-id\nresults report `redriven` or `not_found` (unknown ids, or entries\nconcurrently redriven/expired).\n",
         "tags": [
@@ -3328,6 +3507,12 @@
     "/v1/integrations/{integrationId}/outbound/messages/unblock": {
       "post": {
         "operationId": "unblockOutboundStream",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage",
+            "resource": "integration:{integrationId}"
+          }
+        ],
         "summary": "unblockOutboundStream",
         "description": "Unblock an integration's outbound stream halted by the `block`\npoison policy: skips (dead-letters) the current blocked head message,\nemitting MSG_DEAD_LETTERED and letting the next message become the\nhead. Operator endpoint — requires the `integration:manage` grant.\nReturns `unblocked: false` as a no-op when the stream is not\ncurrently blocked (or the state moved concurrently) — safe to retry.\n",
         "tags": [
@@ -3392,6 +3577,7 @@
     "/v1/integrations/{integrationId}/monitoring/access-logs": {
       "post": {
         "operationId": "queryAccessLogs",
+        "x-epilot-permissions": [],
         "summary": "queryAccessLogs",
         "description": "Query API access logs for a specific integration's organization.\nReturns access token usage analytics filtered by user_id (access token).\nSupports infinite scroll pagination with cursor-based navigation.\n",
         "tags": [
@@ -3442,6 +3628,7 @@
     "/v1/integrations/{integrationId}/monitoring/outbound-events": {
       "post": {
         "operationId": "queryOutboundMonitoringEvents",
+        "x-epilot-permissions": [],
         "summary": "queryOutboundMonitoringEvents",
         "description": "Query outbound monitoring events for a specific integration.\nReturns detailed information about outbound event deliveries,\nfiltered by event_name (event_catalog_event) linked to the integration's outbound use cases.\n",
         "tags": [
@@ -3492,6 +3679,7 @@
     "/v2/integrations/{integrationId}/monitoring/events": {
       "post": {
         "operationId": "queryMonitoringEventsV2",
+        "x-epilot-permissions": [],
         "summary": "queryMonitoringEventsV2",
         "description": "Query monitoring events from the unified erp_monitoring_v2 table.\nReturns all event types (inbound, outbound, file_proxy, etc.) in a single list.\nReplaces the separate v1 inbound-events and outbound-events endpoints.\n",
         "tags": [
@@ -3542,6 +3730,7 @@
     "/v2/integrations/{integrationId}/monitoring/stats": {
       "post": {
         "operationId": "getMonitoringStatsV2",
+        "x-epilot-permissions": [],
         "summary": "getMonitoringStatsV2",
         "description": "Get aggregated statistics from the unified erp_monitoring_v2 table.\nReturns combined metrics for all event types with optional breakdowns.\n",
         "tags": [
@@ -3592,6 +3781,7 @@
     "/v2/integrations/{integrationId}/monitoring/time-series": {
       "post": {
         "operationId": "getMonitoringTimeSeriesV2",
+        "x-epilot-permissions": [],
         "summary": "getMonitoringTimeSeriesV2",
         "description": "Get time-series aggregated event counts from the unified erp_monitoring_v2 table.\nReturns bucketed counts for chart rendering.\n",
         "tags": [
@@ -3642,6 +3832,7 @@
     "/v2/integrations/{integrationId}/monitoring/events/{eventId}/associated": {
       "get": {
         "operationId": "getAssociatedMonitoringEvents",
+        "x-epilot-permissions": [],
         "summary": "getAssociatedMonitoringEvents",
         "description": "Returns all monitoring events sharing the same event_id, ordered chronologically.\nAlso includes the original inbound event payload from erp_incoming_events if available.\nUsed to display a full event trace/timeline.\n",
         "tags": [
@@ -3688,6 +3879,11 @@
     "/v2/integrations/{integrationId}/monitoring/external-events": {
       "post": {
         "operationId": "ingestExternalMonitoringEvents",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "ingestExternalMonitoringEvents",
         "description": "Ingest monitoring spans produced by an EXTERNAL system (e.g. an integration\nmiddleware), so the Integration Hub is the central monitoring point and the\ncross-system event trace spans both the external system and epilot's own\nprocessing.\n\nEach span is validated, assigned a server-controlled `EXTERNAL_*` taxonomy code\nderived from its `level` (the client never supplies a code — this marks\nprovenance and prevents spoofing an epilot code), has its `use_case_slug`\nresolved against the integration's configured use cases, and is republished onto\nthe same monitoring event bus as epilot's own spans — so external spans are\nfirst-class to the trace view, stats, alerting and digests.\n\nSpans link to the epilot trace via `correlation_id` (the trace id): the middleware\nmust stamp the same `correlation_id` here and on the event it forwards to the\ninbound endpoint. Invalid spans in a batch are reported per-item and do not fail\nthe whole batch.\n",
         "tags": [
@@ -3748,6 +3944,11 @@
     "/v2/integrations/{integrationId}/monitoring/traces/{correlationId}": {
       "get": {
         "operationId": "getMonitoringTraceByCorrelation",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "getMonitoringTraceByCorrelation",
         "description": "Returns the cross-system event trace for a `correlation_id`: every monitoring\nspan sharing it — external spans (middleware) plus epilot's own processing spans\n— ordered chronologically, with a rolled-up status and the epilot inbound event\n\"head\" attached. This is the correlation-grouped counterpart to\n`…/events/{eventId}/associated` (which groups a single epilot event's fan-out by\nevent_id). Origin is distinguished by the `EXTERNAL_*` code prefix on external\nspans. Freshness is near-real-time (spans land as they are produced/ingested).\n",
         "tags": [
@@ -3804,6 +4005,11 @@
     "/v1/integrations/secure-proxies": {
       "get": {
         "operationId": "listSecureProxies",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:view"
+          }
+        ],
         "summary": "listSecureProxies",
         "description": "Lists all secure_proxy use cases across all integrations for the authenticated organization.\nReturns minimal data suitable for dropdowns and selection UIs.\n",
         "tags": [
@@ -3848,6 +4054,11 @@
     "/v1/secure-proxy": {
       "post": {
         "operationId": "secureProxy",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "secureProxy",
         "description": "Routes an HTTP request through a VPC with either static IP egress or VPN secure link access.\nThe VPC mode is determined by the referenced secure_proxy use case configuration.\nFor secure_link mode, the target URL must match the use case's allowed_domains whitelist.\n",
         "tags": [
@@ -3931,6 +4142,11 @@
     "/v1/managed-call/{slug}/execute": {
       "post": {
         "operationId": "managedCallExecute",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "managedCallExecute",
         "description": "Execute a managed call operation synchronously. The slug in the path acts as the RPC method name.\nCalls an external partner API with JSONata mapping on both request and response.\n",
         "tags": [
@@ -4020,6 +4236,11 @@
     "/v1/integrations/{integrationId}/generate-types-preview": {
       "post": {
         "operationId": "generateTypesPreview",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "generateTypesPreview",
         "description": "Analyses the JSONata mappings of all managed-call use cases in the integration and returns scaffolded type descriptors. The frontend uses these to show the type editor modal where developers fill in leaf types.\n",
         "tags": [
@@ -4070,6 +4291,11 @@
     "/v1/integrations/{integrationId}/generate-types": {
       "post": {
         "operationId": "generateTypes",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "generateTypes",
         "description": "Generates a complete TypeScript npm package with typed interfaces for all managed-call use cases. This is a stateless operation that does not persist any changes. Use the commit-types endpoint to lock configurations after review.\n",
         "tags": [
@@ -4130,6 +4356,11 @@
     "/v1/integrations/{integrationId}/commit-types": {
       "post": {
         "operationId": "commitTypes",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "commitTypes",
         "description": "Commits the generated types by locking use case configurations and updating version tracking. Should be called after the user reviews and downloads the generated package.\n",
         "tags": [
@@ -4190,6 +4421,11 @@
     "/v2/erp/imports": {
       "post": {
         "operationId": "createErpImport",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "createErpImport",
         "description": "Register an already-uploaded file (S3 ref) as a pricing-file import job. Returns the job and a file preview. Nothing runs yet: no use case is chosen and no validation starts here. Optionally rank candidates with POST /v2/erp/imports/{importId}:suggest-use-cases, then start validation with POST /v2/erp/imports/{importId}:validate.\nPass `import_id` to repoint an existing import at a different file instead, keeping its id and its place in the history — allowed while the import has written nothing.",
         "tags": [
@@ -4253,6 +4489,11 @@
       },
       "get": {
         "operationId": "listErpImports",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "listErpImports",
         "description": "List recent pricing-file import jobs for the org, newest first.\n\nPass `next_cursor` back as `cursor` for the next page. A page can be\nshorter than `limit` and still have more behind it, so stop on\n`next_cursor: null`.\n",
         "tags": [
@@ -4306,6 +4547,11 @@
     "/v2/erp/imports/{importId}": {
       "get": {
         "operationId": "getErpImport",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "getErpImport",
         "description": "Get a pricing-file import job (status, counts, result links).",
         "tags": [
@@ -4345,6 +4591,11 @@
       },
       "delete": {
         "operationId": "deleteErpImport",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "deleteErpImport",
         "description": "Remove an import and the file it owns. Allowed from any status: an import whose run is still in flight is stopped by the deletion, and rows it already wrote stay written.",
         "tags": [
@@ -4379,6 +4630,11 @@
     "/v2/erp/imports/{importId}:validate": {
       "post": {
         "operationId": "validateErpImport",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "validateErpImport",
         "description": "Choose the use case to read this file with, and start the validate phase.\nCallable from PENDING, READY and FAILED — so a wrong choice is corrected by calling this again with a different use case, rather than re-uploading. Each call replaces any previous verdict. Any other status returns 409.",
         "tags": [
@@ -4443,6 +4699,11 @@
     "/v2/erp/imports/{importId}:suggest-use-cases": {
       "post": {
         "operationId": "suggestErpImportUseCases",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "suggestErpImportUseCases",
         "description": "Rank the org's inbound use cases against this file's columns — the input to the ranked picker (\"matches 6 of your 7 columns\"). Optional: skip this and call `:validate` directly when the use case is already known. Reads only the file's first row, not its data.\nEvery eligible use case is returned, including ones matching nothing: the \"nothing fits, pick anyway\" view needs the full list. Highest match first.\nCSV only — an xlsx import fails with 400 rather than silently returning zero matches, which would look identical to \"we checked and nothing matches\".",
         "tags": [
@@ -4487,6 +4748,11 @@
     "/v2/erp/imports/{importId}:execute": {
       "post": {
         "operationId": "executeErpImport",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "executeErpImport",
         "description": "Confirm and run the write phase of a validated import. Only a READY job may be executed; any other status returns 409.\nThe verdict is re-checked against live inputs first: if the mapping or an entity schema changed since the check, this returns 409 `VALIDATION_STALE` and leaves the verdict untouched for `:validate` to re-form.",
         "tags": [
@@ -4558,6 +4824,11 @@
     "/v2/erp/imports/{importId}:abort": {
       "post": {
         "operationId": "abortErpImport",
+        "x-epilot-permissions": [
+          {
+            "action": "integration:manage"
+          }
+        ],
         "summary": "abortErpImport",
         "description": "Ask a running import to stop. Valid while the job is VALIDATING or PROCESSING; any other status returns 409.\nThe stop is cooperative: the job passes through CANCELLING and typically reaches CANCELLED within seconds.\nRows already published to the platform are **kept**: this is a stop, not a rollback. Aborting during VALIDATING has published nothing, so it is always clean; aborting during PROCESSING leaves a partial import, and the rows that landed are visible in monitoring under the job's correlation_id.",
         "tags": [