@knowttl/checkpoint-axi 0.0.0 → 0.1.0

package/docs/commands.md

@@ -0,0 +1,461 @@
+<!-- Generated by scripts/generate-docs.mjs from src/catalogue.ts. Do not hand-edit. -->
+
+# Command reference
+
+Inspect Check Point Email Security through compact, guarded AXI commands.
+Email, event, task and exception reads use the regional API; doctor checks authentication and one bounded search, while discovery commands stay local.
+Run each command with `--help` for concise help.
+
+## attachment download
+
+Download one attachment to a new private file with profile opt-in, a 50 MiB cap and verified x-av-sha256; scope behavior is unverified (guide pages 133-135)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--help` | Show concise command help; default false |
+| `--out` | Required absolute new output file; mode 0600, never stdout or overwrite |
+| `--scope` | Optional authorized scope query; default profile scope when configured; live behavior unverified |
+
+```sh
+checkpoint-axi attachment download <entity-id> <attachment-id> --out /absolute/attachment
+checkpoint-axi attachment download <entity-id> <attachment-id> --scope <scope> --out /absolute/attachment
+```
+
+## attachment download-all
+
+Download available attachments as a ZIP to a new private file with opt-in, a 50 MiB cap and mandatory SHA-256 verification; ZIP hash availability and scopes are unverified; HTTP 200 may contain only some attachments (guide pages 135-137)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--help` | Show concise command help; default false |
+| `--out` | Required absolute new output file; mode 0600, never stdout or overwrite |
+| `--scope` | Optional authorized scope query; default profile scope when configured; live behavior unverified |
+
+```sh
+checkpoint-axi attachment download-all <entity-id> --out /absolute/attachments
+checkpoint-axi attachment download-all <entity-id> --scope <scope> --out /absolute/attachments
+```
+
+## auth status
+
+Validate the selected local profile and secret source without API calls
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+
+```sh
+checkpoint-axi auth status
+checkpoint-axi auth status --profile example
+```
+
+## config path
+
+Show config and state paths without reading files; --profile does not affect paths
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+
+```sh
+checkpoint-axi config path
+checkpoint-axi config path --fields config
+```
+
+## doctor
+
+Check regional API authentication and one bounded email search without printing tenant data
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--saas` | SaaS override; default selected profile saas or office365_emails |
+
+```sh
+checkpoint-axi doctor
+checkpoint-axi doctor --profile example --saas office365_emails
+```
+
+## email download
+
+Download an email to a new private file with profile opt-in, a 50 MiB cap and mandatory SHA-256 verification; scopes and email hash availability are unverified (guide pages 131-132)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--help` | Show concise command help; default false |
+| `--out` | Required absolute new output file; mode 0600, never stdout or overwrite |
+| `--original` | Download original email without processing modifications; default false |
+
+```sh
+checkpoint-axi email download <entity-id> --out /absolute/message
+checkpoint-axi email download <entity-id> --original --out /absolute/original
+```
+
+## email quarantine
+
+Preview or request asynchronous email quarantine through the gated write coordinator (guide pages 28-30)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--ids` | Required comma-separated unique entity IDs; maximum 20 |
+| `--execute` | Send once after all write gates; default false (preview) |
+| `--dry-run` | Explicit preview; cannot combine with --execute |
+| `--confirm` | Exact operation followed by a space and the comma-separated IDs in supplied order |
+
+```sh
+checkpoint-axi email quarantine --ids <id>
+checkpoint-axi email quarantine --ids <id> --execute --confirm 'email.quarantine <id>'
+```
+
+## email restore
+
+Preview or request asynchronous email restore through the gated write coordinator (guide pages 28-30)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--ids` | Required comma-separated unique entity IDs; maximum 20 |
+| `--execute` | Send once after all write gates; default false (preview) |
+| `--dry-run` | Explicit preview; cannot combine with --execute |
+| `--confirm` | Exact operation followed by a space and the comma-separated IDs in supplied order |
+
+```sh
+checkpoint-axi email restore --ids <id>
+checkpoint-axi email restore --ids <id> --execute --confirm 'email.restore <id>'
+```
+
+## email search
+
+Search emails with a bounded date window and scroll continuation (API guide pages 18-27)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--saas` | SaaS override; default selected profile saas or office365_emails |
+| `--saas-entity` | Optional SaaS entity type selector |
+| `--start-date` | ISO timestamp with timezone; default 24 hours before end-date; maximum window 31 days |
+| `--end-date` | ISO timestamp with timezone; default now |
+| `--limit` | Maximum rows; default 50, range 1-1000; cannot combine with --all |
+| `--all` | Read up to 1000 rows / 10 HTTP requests / 60 seconds / 8 MiB; default false |
+| `--cursor` | Opaque continuation bound to profile, region, operation and selectors; repeat original selectors |
+| `--filter` | JSON array of {saasAttrName, saasAttrOp, saasAttrValue} filters (guide pages 19-20) |
+
+```sh
+checkpoint-axi email search
+checkpoint-axi email search --all --saas office365_emails
+checkpoint-axi email search --cursor <cursor>
+```
+
+## email show
+
+Show one email with verdicts, actions and available actions (API guide pages 10-18)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+
+```sh
+checkpoint-axi email show <id>
+checkpoint-axi email show <id> --full
+```
+
+## event action
+
+Preview or request a name-only event action; parameterized actions refuse ENDPOINT_UNVERIFIED pending commissioning (guide pages 35-37, 42-45)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--ids` | Required comma-separated unique event IDs; maximum 20 |
+| `--execute` | Send once after all write gates; default false (preview) |
+| `--dry-run` | Explicit preview; cannot combine with --execute |
+| `--confirm` | Exact operation followed by a space and the comma-separated IDs in supplied order |
+| `--name` | Required available action name; nonempty action parameters are unverified |
+
+```sh
+checkpoint-axi event action --ids <id> --name dismiss
+checkpoint-axi event action --ids <id> --name dismiss --execute --confirm 'event.action.dismiss <id>'
+```
+
+## event list
+
+List security events with bounded scroll continuation (API guide pages 37-42)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--start-date` | ISO timestamp with timezone; default 24 hours before end-date; maximum window 31 days |
+| `--end-date` | ISO timestamp with timezone; default now |
+| `--limit` | Maximum rows; default 50, range 1-1000; cannot combine with --all |
+| `--all` | Read up to 1000 rows / 10 HTTP requests / 60 seconds / 8 MiB; default false |
+| `--cursor` | Opaque continuation bound to profile, region, operation and selectors; repeat original selectors |
+| `--saas` | Comma-separated SaaS overrides; default selected profile saas or office365_emails |
+| `--event-types` | Comma-separated event types; default unfiltered |
+| `--event-states` | Comma-separated event states; default unfiltered |
+| `--severities` | Comma-separated severities; default unfiltered |
+| `--event-ids` | Comma-separated event IDs; default unfiltered |
+| `--confidence-indicator` | Confidence indicator selector; default unfiltered |
+| `--description` | Description selector; default unfiltered |
+
+```sh
+checkpoint-axi event list
+checkpoint-axi event list --all --event-types phishing
+checkpoint-axi event list --cursor <cursor>
+```
+
+## event show
+
+Show one event, actions taken and available actions (API guide pages 34-37)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+
+```sh
+checkpoint-axi event show <id>
+checkpoint-axi event show <id> --full
+```
+
+## exception clear
+
+Refuse click-time/malware/url/dlp clear with ENDPOINT_UNVERIFIED until commissioning establishes counts and delete contracts (guide pages 87-88, 96-97, 107-110, 117-120, 128-131)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--execute` | Send once after all write gates; default false (preview) |
+| `--dry-run` | Explicit preview; cannot combine with --execute |
+| `--confirm` | Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise) |
+
+```sh
+checkpoint-axi exception clear click-time
+checkpoint-axi exception clear click-time --dry-run
+```
+
+## exception create
+
+Preview or create one exception of any kind; anomaly/click-time/malware/url/dlp response identities are unverified (guide pages 61-64, 75-78, 84-85, 91-93, 102-105, 113-116, 123-126)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--execute` | Send once after all write gates; default false (preview) |
+| `--dry-run` | Explicit preview; cannot combine with --execute |
+| `--confirm` | Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise) |
+| `--input` | Required absolute private JSON file containing documented requestData fields directly; fields depend on kind; update sends a replacement PUT |
+| `--specific` | Malware/url/dlp only: use the documented create-specific /exceptions route; default false; included in confirmation digest |
+
+```sh
+checkpoint-axi exception create phishing-allow --input /absolute/rule.json
+checkpoint-axi exception create spam-allow --input /absolute/rule.json --execute --confirm 'exception.spam-allow.create sha256:<preview-digest>'
+```
+
+## exception list
+
+List bounded exceptions for phishing-allow, phishing-block, spam-allow, anomaly, click-time, malware, url or dlp (guide pages 49-123)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--type` | Required for malware: hash,micro_hash,file_type,ppat_sender_name,allow_file_type,sender_email; url: allow-url,allow-domain,block-url,block-domain; dlp: hash,text_content,sender_email,recipient_email |
+| `--items` | Click-time item routes instead of list routes; default false |
+| `--limit` | Maximum rows; default 50, range 1-1000; cannot combine with --all |
+| `--all` | Return up to 1000 rows within transport budgets; no server continuation parameter is documented |
+
+```sh
+checkpoint-axi exception list phishing-allow
+checkpoint-axi exception list malware --type hash
+checkpoint-axi exception list click-time --items --all
+```
+
+## exception remove
+
+Preview or remove one phishing/spam/anomaly/click-time exception by ID; malware/url/dlp refuse ENDPOINT_UNVERIFIED before authentication (guide pages 67-69, 81-82, 85-87, 98-99, 108-110, 119-120, 129-131)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--execute` | Send once after all write gates; default false (preview) |
+| `--dry-run` | Explicit preview; cannot combine with --execute |
+| `--confirm` | Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise) |
+
+```sh
+checkpoint-axi exception remove phishing-allow <id>
+checkpoint-axi exception remove spam-allow <id> --execute --confirm 'exception.spam-allow.remove <id>'
+```
+
+## exception remove-items
+
+Preview or remove 1-20 click-time items by caller-supplied IDs; existence is unverified (guide pages 97-98)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--execute` | Send once after all write gates; default false (preview) |
+| `--dry-run` | Explicit preview; cannot combine with --execute |
+| `--confirm` | Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise) |
+| `--ids` | Required 1-20 unique comma-separated click-time item IDs |
+
+```sh
+checkpoint-axi exception remove-items click-time --ids <id1>,<id2>
+checkpoint-axi exception remove-items click-time --ids <id1>,<id2> --execute --confirm 'exception.click-time.remove-items <id1>,<id2>'
+```
+
+## exception show
+
+Show an exception by kind and ID/value; anomaly refuses ENDPOINT_UNVERIFIED pending commissioning (guide pages 52-123)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--type` | Required for malware: hash,micro_hash,file_type,ppat_sender_name,allow_file_type,sender_email; url: allow-url,allow-domain,block-url,block-domain; dlp: hash,text_content,sender_email,recipient_email |
+| `--items` | Click-time item route instead of list route; default false |
+
+```sh
+checkpoint-axi exception show phishing-block <id>
+checkpoint-axi exception show url <value> --type allow-url
+checkpoint-axi exception show click-time <id> --items --full
+```
+
+## exception update
+
+Preview or replace one exception; phishing/spam/click-time require an ID; malware/url/dlp identify it in --input without an ID; anomaly unsupported (guide pages 64-67, 78-81, 94-96, 105-107, 116-117, 126-127)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+| `--execute` | Send once after all write gates; default false (preview) |
+| `--dry-run` | Explicit preview; cannot combine with --execute |
+| `--confirm` | Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise) |
+| `--input` | Required absolute private JSON file containing documented requestData fields directly; fields depend on kind; update sends a replacement PUT |
+
+```sh
+checkpoint-axi exception update phishing-block <id> --input /absolute/rule.json
+checkpoint-axi exception update spam-allow <id> --input /absolute/rule.json --execute --confirm 'exception.spam-allow.update <id>'
+```
+
+## home
+
+Show local profile context without resolving secrets or making API calls
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+
+```sh
+checkpoint-axi
+checkpoint-axi home --profile example
+```
+
+## profile list
+
+List file profiles without resolving secrets; --profile does not filter this list
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+
+```sh
+checkpoint-axi profile list
+checkpoint-axi profile list --config /example/config.json
+```
+
+## task show
+
+Show asynchronous task status and per-action details (API guide pages 30-33)
+
+| Flag | Meaning |
+|---|---|
+| `--config` | Config path; default CHECKPOINT_AXI_CONFIG or platform path |
+| `--profile` | Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile |
+| `--fields` | Comma-separated output fields; default all |
+| `--full` | Show full strings instead of 500-character previews; default false |
+| `--help` | Show concise command help; default false |
+
+```sh
+checkpoint-axi task show <id>
+checkpoint-axi task show <id> --full
+```

package/inventory/capabilities.json

@@ -0,0 +1,217 @@
+{
+  "schemaVersion": 1,
+  "sources": [
+    {
+      "id": "email-security-api",
+      "title": "Email Security API Reference Guide",
+      "revision": "2026-10-23",
+      "url": "https://sc1.checkpoint.com/documents/Harmony_Email_and_Collaboration_API_Reference/CP_Check_Point_Email_Security_API_Reference_Guide.pdf",
+      "sha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "bytes": 2596219,
+      "pages": 138,
+      "redistributed": false
+    }
+  ],
+  "coverage": [
+    {
+      "capability": "auth exchange and doctor",
+      "pages": "8-9",
+      "slice": "C2",
+      "disposition": "auth",
+      "reason": "Shipped in C2; commission the undocumented token contract manually.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "email search and show",
+      "pages": "10-27",
+      "slice": "C3",
+      "disposition": "read",
+      "reason": "Shipped in C3; GET entity detail and POST search/query with bounded scroll.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "event list and show",
+      "pages": "34-42",
+      "slice": "C4",
+      "disposition": "read",
+      "reason": "Shipped in C4; GET event detail and POST event/query with bounded scroll.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "task show",
+      "pages": "30-33",
+      "slice": "C4",
+      "disposition": "read",
+      "reason": "Shipped in C4; GET task status and per-action details for asynchronous actions.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "legacy exception reads",
+      "pages": "49-55",
+      "slice": "C5",
+      "disposition": "read",
+      "reason": "Shipped in C5 through phishing-allow and phishing-block list/show; same whitelist/blacklist routes.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "exception list and show for eight kinds",
+      "pages": "55-131",
+      "slice": "C5",
+      "disposition": "read",
+      "reason": "Shipped in C5; documented family/item reads; anomaly show refuses ENDPOINT_UNVERIFIED pending response identity commissioning.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "email quarantine and restore",
+      "pages": "28-30",
+      "slice": "C6",
+      "disposition": "write",
+      "reason": "Shipped in C6; POST action/entity through the gated coordinator with durable intent, exact confirmation, re-read and no retry.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "event action",
+      "pages": "42-45",
+      "slice": "C7",
+      "disposition": "write",
+      "reason": "Shipped in C7; gated POST action/event validates availableEventActions; parameterized actions refuse ENDPOINT_UNVERIFIED pending commissioning.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "phishing create update remove",
+      "pages": "61-69",
+      "slice": "C8",
+      "disposition": "write",
+      "reason": "Shipped in C8; gated allow/block create, PUT replacement and bodyless POST remove with exact scope and confirmation.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "spam create update remove",
+      "pages": "75-83",
+      "slice": "C8",
+      "disposition": "write",
+      "reason": "Shipped in C8; gated allow-list create, PUT replacement and bodyless POST remove with exact scope and confirmation.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "anomaly create remove",
+      "pages": "84-87",
+      "slice": "C9",
+      "disposition": "write",
+      "reason": "Shipped in C9; gated shared POST distinguished by documented request bodies; response identities remain unverified.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "click-time create update remove remove-items clear",
+      "pages": "91-100",
+      "slice": "C9",
+      "disposition": "write",
+      "reason": "Shipped in C9; gated item writes; clear refuses ENDPOINT_UNVERIFIED and collection PUT is deferred until commissioning.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "malware create update",
+      "pages": "102-106",
+      "slice": "C10",
+      "disposition": "write",
+      "reason": "Shipped in C10; gated create, create-specific and PUT modify checkpoint2; response identities remain unverified.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "url create update",
+      "pages": "113-117",
+      "slice": "C10",
+      "disposition": "write",
+      "reason": "Shipped in C10; gated create, create-specific and PUT modify avanan_url; response identities remain unverified.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "dlp create update",
+      "pages": "123-127",
+      "slice": "C10",
+      "disposition": "write",
+      "reason": "Shipped in C10; gated create, create-specific and PUT modify avanan_dlp; response identities remain unverified.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "malware remove clear",
+      "pages": "107-110",
+      "slice": "C10",
+      "disposition": "unverified",
+      "reason": "Refuse two ambiguous deletes with ENDPOINT_UNVERIFIED pending commissioning.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": false
+    },
+    {
+      "capability": "url remove clear",
+      "pages": "117-120",
+      "slice": "C10",
+      "disposition": "unverified",
+      "reason": "Refuse two ambiguous deletes with ENDPOINT_UNVERIFIED pending commissioning.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": false
+    },
+    {
+      "capability": "dlp remove clear",
+      "pages": "128-131",
+      "slice": "C10",
+      "disposition": "unverified",
+      "reason": "Refuse two ambiguous deletes with ENDPOINT_UNVERIFIED pending commissioning.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": false
+    },
+    {
+      "capability": "email and attachment downloads",
+      "pages": "131-137",
+      "slice": "C11",
+      "disposition": "download",
+      "reason": "Shipped in C11; opt-in private files, 50 MiB cap and mandatory SHA-256; scopes and email/ZIP hash availability remain unverified.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": true
+    },
+    {
+      "capability": "audit logs",
+      "pages": "138",
+      "slice": "C12",
+      "disposition": "excluded",
+      "reason": "Outside this API; use Check Point Portal APIs separately.",
+      "source": "email-security-api",
+      "sourceSha256": "77d99a258462f13890743811aaaae797843a3d1890bf5726b0b008f0296f5825",
+      "executable": false
+    }
+  ]
+}