@knowttl/mg-axi 0.1.1 → 0.1.3

package/dist/api.js

@@ -1,16 +1,20 @@
 import { AxiError } from "axi-sdk-js";
 import { KNOWN_CONTACTED_REVIEWER_FIELDS, KNOWN_DECISION_FIELDS, KNOWN_DEFINITION_FIELDS, KNOWN_INSTANCE_FIELDS, KNOWN_STAGE_FIELDS } from "./entra-access-reviews.js";
 import { KNOWN_ACCESS_PACKAGE_FIELDS, KNOWN_ASSIGNMENT_POLICY_FIELDS, KNOWN_CATALOG_FIELDS, KNOWN_RESOURCE_ROLE_SCOPE_FIELDS } from "./entra-entitlement-management.js";
-import { KNOWN_LIFECYCLE_SETTINGS_FIELDS, KNOWN_RUN_FIELDS, KNOWN_SUBJECT_PROCESSING_FIELDS, KNOWN_TASK_DEFINITION_FIELDS, KNOWN_TASK_FIELDS, KNOWN_TASK_REPORT_FIELDS, KNOWN_USER_PROCESSING_FIELDS, KNOWN_WORKFLOW_FIELDS, KNOWN_WORKFLOW_TEMPLATE_FIELDS } from "./entra-lifecycle-workflows.js";
+import { KNOWN_LIFECYCLE_SETTINGS_FIELDS, KNOWN_RUN_FIELDS, KNOWN_SUBJECT_PROCESSING_FIELDS, KNOWN_TASK_DEFINITION_FIELDS, KNOWN_TASK_FIELDS, KNOWN_TASK_PROCESSING_FIELDS, KNOWN_TASK_REPORT_FIELDS, KNOWN_USER_PROCESSING_FIELDS, KNOWN_WORKFLOW_FIELDS, KNOWN_WORKFLOW_TEMPLATE_FIELDS } from "./entra-lifecycle-workflows.js";
 import { KNOWN_BRANDING_FIELDS, KNOWN_ORGANIZATION_FIELDS } from "./entra-organization.js";
 import { KNOWN_CONTRACT_FIELDS } from "./entra-contracts.js";
 import { KNOWN_DELEGATED_ADMIN_CUSTOMER_FIELDS, KNOWN_DELEGATED_ADMIN_RELATIONSHIP_FIELDS, KNOWN_DELEGATED_ADMIN_ACCESS_ASSIGNMENT_FIELDS, KNOWN_DELEGATED_ADMIN_OPERATION_FIELDS, KNOWN_DELEGATED_ADMIN_REQUEST_FIELDS } from "./entra-delegated-admin.js";
 import { KNOWN_TENANT_INFORMATION_FIELDS } from "./entra-tenant-information.js";
 import { KNOWN_MTO_FIELDS, KNOWN_MTO_JOIN_REQUEST_FIELDS, KNOWN_MTO_TENANT_FIELDS } from "./entra-multi-tenant-organization.js";
 import { KNOWN_DATA_POLICY_FIELDS } from "./entra-data-policy-operations.js";
+import { KNOWN_FRAUD_FIELDS, KNOWN_WAF_FIELDS, KNOWN_VERIFICATION_FIELDS } from "./entra-risk-prevention.js";
 import { KNOWN_FEDERATION_FIELDS } from "./entra-federation-configurations.js";
 import { KNOWN_CA_FIELDS, KNOWN_PKI_FIELDS } from "./entra-certificate-auth.js";
+import { KNOWN_AUTH_CONTEXT_FIELDS, KNOWN_COMBO_FIELDS, KNOWN_DELETED_LOCATION_FIELDS, KNOWN_DELETED_POLICY_FIELDS, KNOWN_MODE_FIELDS, KNOWN_STRENGTH_FIELDS, KNOWN_TEMPLATE_FIELDS as KNOWN_CA_TEMPLATE_FIELDS } from "./entra-conditional-access.js";
 import { KNOWN_SUBSCRIPTION_FIELDS } from "./entra-subscriptions.js";
+import { KNOWN_TEMPLATE_FIELDS as KNOWN_ROLE_TEMPLATE_FIELDS, KNOWN_ROLE_MEMBER_FIELDS, KNOWN_SCOPED_MEMBER_FIELDS } from "./entra-roles.js";
+import { KNOWN_ASSIGNMENT_INSTANCE_FIELDS, KNOWN_ASSIGNMENT_SCHEDULE_FIELDS, KNOWN_ELIGIBILITY_INSTANCE_FIELDS, KNOWN_ELIGIBILITY_REQUEST_FIELDS, KNOWN_ELIGIBILITY_SCHEDULE_FIELDS } from "./entra-group-pim.js";
 import { KNOWN_SYNC_FIELDS } from "./entra-on-premises-synchronization.js";
 import { KNOWN_ACCEPTANCE_FIELDS, KNOWN_AGREEMENT_FIELDS } from "./entra-terms-of-use.js";
 import { KNOWN_DIRECTORY_OBJECT_FIELDS } from "./entra-directory-objects.js";
@@ -41,7 +45,7 @@ import { encodeGraphPathSegment, functionBindingFor, GraphSession, resolveSessio
 // preview, /me and sensitive-area policy still runs inside the shared session,
 // so raw reads cannot bypass named-command gating.
 export const REVIEWED_ON = "2026-10-04";
-const TRUNCATE_AT = 4000;
+const TRUNCATE_AT = 500;
 // Collections support server filtering, ordering and paging hints. Advanced
 // queries ($search, $count=true) need per-endpoint ConsistencyLevel review and
 // stay unsupported here; $skiptoken is server paging state, paged via --all.
@@ -57,12 +61,17 @@ const AUTH_METHOD_FIELDS = ["id", "createdDateTime", "displayName", "phoneNumber
 const REGISTRATION_FIELDS = ["id", "userPrincipalName", "userDisplayName", "userType", "isAdmin", "isMfaRegistered", "isMfaCapable", "isPasswordlessCapable", "isSsprRegistered", "isSsprEnabled", "isSsprCapable", "userPreferredMethodForSecondaryAuthentication", "lastUpdatedDateTime"];
 const SIGNIN_FIELDS = ["id", "createdDateTime", "userId", "userPrincipalName", "userDisplayName", "appDisplayName", "appId", "ipAddress", "location", "status", "conditionalAccessStatus", "riskDetail", "riskLevelAggregated", "riskLevelDuringSignIn", "riskState", "resourceDisplayName", "resourceId", "clientAppUsed"];
 const AUDIT_FIELDS = ["id", "activityDateTime", "activityDisplayName", "category", "loggedByService", "operationType", "result", "resultReason", "correlationId", "initiatedBy", "targetResources"];
+const PROVISIONING_FIELDS = ["id", "activityDateTime", "tenantId", "jobId", "cycleId", "changeId", "action", "durationInMilliseconds", "sourceSystem", "sourceIdentity", "targetSystem", "targetIdentity", "provisioningStatusInfo", "provisioningSteps", "modifiedProperties", "servicePrincipal", "initiatedBy"];
 const RISKY_USER_FIELDS = ["id", "userPrincipalName", "userDisplayName", "riskDetail", "riskLastUpdatedDateTime", "riskLevel", "riskState"];
 const RISK_DETECTION_FIELDS = ["id", "detectedDateTime", "activityDateTime", "userId", "userPrincipalName", "userDisplayName", "ipAddress", "location", "riskDetail", "riskLevel", "riskState", "riskEventType", "detectionTimingType", "lastUpdatedDateTime", "source"];
+const RISKY_SP_FIELDS = ["id", "displayName", "appId", "servicePrincipalType", "riskDetail", "riskLastUpdatedDateTime", "riskLevel", "riskState", "isEnabled", "isProcessing"];
+const RISKY_SP_HISTORY_FIELDS = ["id", "displayName", "appId", "servicePrincipalType", "servicePrincipalId", "riskDetail", "riskLastUpdatedDateTime", "riskLevel", "riskState", "isEnabled", "isProcessing", "initiatedBy", "activity"];
+const SP_DETECTION_FIELDS = ["id", "detectedDateTime", "activityDateTime", "servicePrincipalId", "servicePrincipalDisplayName", "appId", "keyIds", "ipAddress", "location", "riskDetail", "riskLevel", "riskState", "riskEventType", "detectionTimingType", "lastUpdatedDateTime", "source", "additionalInfo"];
 const APP_FIELDS = ["id", "appId", "displayName", "createdDateTime", "signInAudience", "publisherDomain", "keyCredentials", "passwordCredentials", "requiredResourceAccess", "web", "spa", "publicClient"];
 const SP_FIELDS = ["id", "appId", "displayName", "servicePrincipalType", "accountEnabled", "appOwnerOrganizationId", "appRoleAssignmentRequired", "preferredSingleSignOnMode", "loginUrl"];
 const GRANT_FIELDS = ["id", "clientId", "consentType", "principalId", "resourceId", "scope", "startTime", "expiryTime"];
 const APP_ROLE_FIELDS = ["id", "appRoleId", "principalId", "principalDisplayName", "principalType", "resourceId", "resourceDisplayName", "createdDateTime"];
+const FEDERATED_FIELDS = ["id", "name", "issuer", "subject", "description", "audiences"];
 const ROLE_ASSIGNMENT_FIELDS = ["id", "principalId", "roleDefinitionId", "directoryScopeId", "appScopeId", "createdDateTime"];
 const PIM_INSTANCE_FIELDS = ["id", "roleDefinitionId", "principalId", "assignmentType", "memberType", "startDateTime", "endDateTime", "activatedUsing"];
 const DEVICE_FIELDS = ["id", "deviceId", "displayName", "operatingSystem", "operatingSystemVersion", "trustType", "isCompliant", "isManaged", "accountEnabled", "createdDateTime", "approximateLastSignInDateTime", "manufacturer", "model"];
@@ -104,6 +113,62 @@ export const REVIEWED_ROUTES = [
     { id: "v1.0:GET:/identity/conditionalAccess/namedLocations/{namedLocation-id}", kind: "single", query: SINGLE_QUERY, fields: NAMED_LOCATION_FIELDS,
         access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (for example Security Reader) is also required.",
         sources: ["https://learn.microsoft.com/graph/api/countrynamedlocation-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_STRENGTH_FIELDS,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/authenticationstrengthroot-list-policies?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_STRENGTH_FIELDS,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/authenticationstrengthpolicy-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}/combinationConfigurations", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_COMBO_FIELDS, keepODataType: true,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1. Rows are polymorphic: the @odata.type discriminator rides along automatically to name the configuration kind.",
+        sources: ["https://learn.microsoft.com/graph/api/authenticationstrengthpolicy-list-combinationconfigurations?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/policies/{authenticationStrengthPolicy-id}/combinationConfigurations/{authenticationCombinationConfiguration-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_COMBO_FIELDS, keepODataType: true,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1. Rows are polymorphic: the @odata.type discriminator rides along automatically to name the configuration kind.",
+        sources: ["https://learn.microsoft.com/graph/api/authenticationcombinationconfiguration-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/authenticationMethodModes", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_MODE_FIELDS,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/graph/api/authenticationstrengthroot-list-authenticationmethodmodes?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationStrength/authenticationMethodModes/{authenticationMethodModeDetail-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_MODE_FIELDS,
+        access: "D/A Policy.Read.AuthenticationMethod. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/authenticationmethodmodedetail-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/templates", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_CA_TEMPLATE_FIELDS,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (for example Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/conditionalaccessroot-list-templates?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/templates/{conditionalAccessTemplate-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_CA_TEMPLATE_FIELDS,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (for example Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/conditionalaccesstemplate-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationContextClassReferences", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_AUTH_CONTEXT_FIELDS,
+        access: "D/A AuthenticationContext.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/graph/api/conditionalaccessroot-list-authenticationcontextclassreferences?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/authenticationContextClassReferences/{authenticationContextClassReference-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_AUTH_CONTEXT_FIELDS,
+        access: "D/A AuthenticationContext.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "The get page documents no optional query parameters; $select travels as the standard single-object projection. Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/graph/api/authenticationcontextclassreference-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/deletedItems/policies", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_DELETED_POLICY_FIELDS,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "No v1.0 operation-level documentation page; access follows the beta policyDeletableItem contract for conditional-access objects with the conditionalAccessPolicy resource reference. Soft-deleted policies restore within 30 days; restore is beta-only and out of scope. Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/policydeletableitem-list?view=graph-rest-beta", "https://learn.microsoft.com/en-us/graph/api/resources/policydeletableitem?view=graph-rest-beta"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/deletedItems/policies/{conditionalAccessPolicy-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_DELETED_POLICY_FIELDS,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "No v1.0 operation-level documentation page; access follows the beta policyDeletableItem contract for conditional-access objects with the conditionalAccessPolicy resource reference. Soft-deleted policies restore within 30 days; restore is beta-only and out of scope. Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/policydeletableitem-get?view=graph-rest-beta", "https://learn.microsoft.com/en-us/graph/api/resources/policydeletableitem?view=graph-rest-beta"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/deletedItems/namedLocations", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_DELETED_LOCATION_FIELDS, keepODataType: true,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "No v1.0 operation-level documentation page; access follows the beta policyDeletableItem contract for conditional-access objects with the namedLocation resource reference. Rows are polymorphic: the @odata.type discriminator rides along automatically to name the location kind. Soft-deleted locations restore within 30 days; restore is beta-only and out of scope. Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/policydeletableitem-list?view=graph-rest-beta", "https://learn.microsoft.com/en-us/graph/api/resources/policydeletableitem?view=graph-rest-beta"] },
+    { id: "v1.0:GET:/identity/conditionalAccess/deletedItems/namedLocations/{namedLocation-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_DELETED_LOCATION_FIELDS, keepODataType: true,
+        access: "D/A Policy.Read.All. Delegated callers pass it as --scopes; a supported administrator role (Conditional Access Administrator, Global Reader, Global Secure Access Administrator, Security Administrator or Security Reader) is also required.",
+        note: "No v1.0 operation-level documentation page; access follows the beta policyDeletableItem contract for conditional-access objects with the namedLocation resource reference. Soft-deleted locations restore within 30 days; restore is beta-only and out of scope. Conditional Access needs P1.",
+        sources: ["https://learn.microsoft.com/en-us/graph/api/policydeletableitem-get?view=graph-rest-beta", "https://learn.microsoft.com/en-us/graph/api/resources/policydeletableitem?view=graph-rest-beta"] },
     { id: "v1.0:GET:/users/{user-id}/authentication/methods", kind: "collection", query: ["$select"], fields: AUTH_METHOD_FIELDS,
         access: "D/A UserAuthenticationMethod.Read.All for other users; delegated self UserAuthenticationMethod.Read. Dedicated administrator roles also apply.",
         note: "Targeted per-user inspection only; aggregate coverage belongs to the registration report, never to a scan across users.",
@@ -122,6 +187,10 @@ export const REVIEWED_ROUTES = [
     { id: "v1.0:GET:/auditLogs/directoryAudits", kind: "collection", query: COLLECTION_QUERY, fields: AUDIT_FIELDS,
         access: "D/A AuditLog.Read.All. Delegated callers pass it as --scopes.",
         sources: ["https://learn.microsoft.com/graph/api/directoryaudit-list?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/auditLogs/provisioning", kind: "collection", query: COLLECTION_QUERY, fields: PROVISIONING_FIELDS,
+        access: "D/A AuditLog.Read.All and Directory.Read.All. Delegated callers pass both as --scopes; Reports Reader is the least privileged directory role.",
+        note: "Entra ID P1/P2 licence prerequisite; retention is 30 days on premium and 7 days on free.",
+        sources: ["https://learn.microsoft.com/graph/api/provisioningobjectsummary-list?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/identityProtection/riskyUsers", kind: "collection", query: COLLECTION_QUERY, fields: RISKY_USER_FIELDS,
         access: "D/A IdentityRiskyUser.Read.All. Delegated callers pass it as --scopes.",
         note: "Full investigation needs P2/Suite; limited results stay limited, never reinterpreted as empty.",
@@ -136,6 +205,28 @@ export const REVIEWED_ROUTES = [
     { id: "v1.0:GET:/identityProtection/riskDetections/{riskDetection-id}", kind: "single", query: SINGLE_QUERY, fields: RISK_DETECTION_FIELDS,
         access: "D/A IdentityRiskEvent.Read.All. Delegated callers pass it as --scopes.",
         sources: ["https://learn.microsoft.com/graph/api/riskdetection-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityProtection/riskyServicePrincipals", kind: "collection", query: COLLECTION_QUERY, fields: RISKY_SP_FIELDS,
+        access: "D/A IdentityRiskyServicePrincipal.Read.All. Delegated callers pass it as --scopes.",
+        note: "The riskyServicePrincipals API requires a Microsoft Entra Workload Identities Premium licence; limited results stay limited, never reinterpreted as empty.",
+        sources: ["https://learn.microsoft.com/graph/api/identityprotectionroot-list-riskyserviceprincipals?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}", kind: "single", query: SINGLE_QUERY, fields: RISKY_SP_FIELDS,
+        access: "D/A IdentityRiskyServicePrincipal.Read.All. Delegated callers pass it as --scopes.",
+        sources: ["https://learn.microsoft.com/graph/api/riskyserviceprincipal-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}/history", kind: "collection", query: COLLECTION_QUERY, fields: RISKY_SP_HISTORY_FIELDS,
+        access: "D/A IdentityRiskyServicePrincipal.Read.All. Delegated callers pass it as --scopes.",
+        note: "Per-principal risk history; history items inherit the principal properties and add the service-principal identifier with the actor/activity of the change.",
+        sources: ["https://learn.microsoft.com/graph/api/riskyserviceprincipal-list-history?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityProtection/riskyServicePrincipals/{riskyServicePrincipal-id}/history/{riskyServicePrincipalHistoryItem-id}", kind: "single", query: SINGLE_QUERY, fields: RISKY_SP_HISTORY_FIELDS,
+        access: "D/A IdentityRiskyServicePrincipal.Read.All. Delegated callers pass it as --scopes.",
+        note: "No operation-level documentation page; access follows the parent history-list contract and the history-item resource reference.",
+        sources: ["https://learn.microsoft.com/graph/api/riskyserviceprincipal-list-history?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/riskyserviceprincipalhistoryitem?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityProtection/servicePrincipalRiskDetections", kind: "collection", query: COLLECTION_QUERY, fields: SP_DETECTION_FIELDS,
+        access: "D/A IdentityRiskEvent.Read.All. Delegated callers pass it as --scopes.",
+        note: "The servicePrincipalRiskDetection API requires a Microsoft Entra Workload Identities Premium licence; riskDetail and riskLevel report hidden without it.",
+        sources: ["https://learn.microsoft.com/graph/api/identityprotectionroot-list-serviceprincipalriskdetections?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityProtection/servicePrincipalRiskDetections/{servicePrincipalRiskDetection-id}", kind: "single", query: SINGLE_QUERY, fields: SP_DETECTION_FIELDS,
+        access: "D/A IdentityRiskEvent.Read.All. Delegated callers pass it as --scopes.",
+        sources: ["https://learn.microsoft.com/graph/api/serviceprincipalriskdetection-get?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/applications", kind: "collection", query: COLLECTION_QUERY, fields: APP_FIELDS,
         access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
         note: "appId (client ID) is distinct from the object id. Credential fields carry expiry metadata only; GET never returns secret values and success redaction still applies.",
@@ -156,6 +247,34 @@ export const REVIEWED_ROUTES = [
         access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
         note: "Actual granted assignments; requested permissions are a separate contract.",
         sources: ["https://learn.microsoft.com/graph/api/serviceprincipal-list-approleassignments?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignments/{appRoleAssignment-id}", kind: "single", query: SINGLE_QUERY, fields: APP_ROLE_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "One granted assignment on the client service principal; requested permissions are a separate contract.",
+        sources: ["https://learn.microsoft.com/graph/api/approleassignment-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo", kind: "collection", query: COLLECTION_QUERY, fields: APP_ROLE_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "Principals assigned to this resource service principal; the reverse view of appRoleAssignments.",
+        sources: ["https://learn.microsoft.com/graph/api/serviceprincipal-list-approleassignedto?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo/{appRoleAssignment-id}", kind: "single", query: SINGLE_QUERY, fields: APP_ROLE_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "One principal assignment on the resource service principal; the reverse view of appRoleAssignments.",
+        sources: ["https://learn.microsoft.com/graph/api/approleassignment-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/applications/{application-id}/federatedIdentityCredentials", kind: "collection", query: COLLECTION_QUERY, fields: FEDERATED_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "Workload-identity trust metadata only; GET never returns secret values and success redaction still applies.",
+        sources: ["https://learn.microsoft.com/graph/api/federatedidentitycredential-list?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/applications/{application-id}/federatedIdentityCredentials/{federatedIdentityCredential-id}", kind: "single", query: SINGLE_QUERY, fields: FEDERATED_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "One workload-identity trust entry; metadata only, never secret values.",
+        sources: ["https://learn.microsoft.com/graph/api/federatedidentitycredential-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/servicePrincipals/{servicePrincipal-id}/federatedIdentityCredentials", kind: "collection", query: COLLECTION_QUERY, fields: FEDERATED_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "Same federatedIdentityCredential resource contract as the application navigation; metadata only, never secret values.",
+        sources: ["https://learn.microsoft.com/graph/api/federatedidentitycredential-list?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/federatedidentitycredential?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/servicePrincipals/{servicePrincipal-id}/federatedIdentityCredentials/{federatedIdentityCredential-id}", kind: "single", query: SINGLE_QUERY, fields: FEDERATED_FIELDS,
+        access: "D/A Application.Read.All. Delegated callers pass it as --scopes.",
+        note: "Same federatedIdentityCredential resource contract as the application navigation; metadata only, never secret values.",
+        sources: ["https://learn.microsoft.com/graph/api/federatedidentitycredential-get?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/federatedidentitycredential?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/oauth2PermissionGrants", kind: "collection", query: COLLECTION_QUERY, fields: GRANT_FIELDS,
         access: "D/A Directory.Read.All as the read choice. Delegated callers pass it as --scopes.",
         note: "Actual granted consent; requested permissions are a separate contract.",
@@ -175,6 +294,73 @@ export const REVIEWED_ROUTES = [
         access: "D/A RoleAssignmentSchedule.Read.Directory. Delegated callers pass it as --scopes.",
         note: "Active (including activated eligible) assignments; PIM needs P2 or ID Governance.",
         sources: ["https://learn.microsoft.com/graph/api/rbacapplication-list-roleassignmentscheduleinstances?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/directoryRoleTemplates", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ROLE_TEMPLATE_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Templates describe every role; activation state lives on directoryRoles.",
+        sources: ["https://learn.microsoft.com/graph/api/directoryroletemplate-list?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/directoryRoleTemplates/{directoryRoleTemplate-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_ROLE_TEMPLATE_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        sources: ["https://learn.microsoft.com/graph/api/directoryroletemplate-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/directoryRoles/{directoryRole-id}/members", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ROLE_MEMBER_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Members are the assigned principals; @odata.type names each member kind.",
+        sources: ["https://learn.microsoft.com/graph/api/directoryrole-list-members?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/directoryRoles/{directoryRole-id}/scopedMembers", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Scoped members bind one role to one principal within one directory scope; administrative-unit scopes need P1.",
+        sources: ["https://learn.microsoft.com/graph/api/directoryrole-list-scopedmembers?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/directoryRoles/{directoryRole-id}/scopedMembers/{scopedRoleMembership-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Administrative-unit scopes need P1.",
+        sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/scopedRoleMemberships", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Administrative-unit-scoped admin assignments; directory-wide assignments live on roleAssignments. Administrative-unit scopes need P1.",
+        sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-list?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/scopedRoleMemberships/{scopedRoleMembership-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_SCOPED_MEMBER_FIELDS,
+        access: "D/A RoleManagement.Read.Directory. Delegated callers pass it as --scopes.",
+        note: "Administrative-unit scopes need P1.",
+        sources: ["https://learn.microsoft.com/graph/api/scopedrolemembership-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/assignmentSchedules", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ASSIGNMENT_SCHEDULE_FIELDS,
+        access: "D/A PrivilegedAssignmentSchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
+        note: "Assignment schedules govern group membership or ownership over time; PIM for Groups needs P2 or ID Governance; lists require $filter on groupId or principalId. AssignmentScheduleRequests stay out: their least privilege is the write scope PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup.",
+        sources: ["https://learn.microsoft.com/graph/api/privilegedaccessgroup-list-assignmentschedules?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_ASSIGNMENT_SCHEDULE_FIELDS,
+        access: "D/A PrivilegedAssignmentSchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
+        note: "PIM for Groups needs P2 or ID Governance.",
+        sources: ["https://learn.microsoft.com/graph/api/privilegedaccessgroupassignmentschedule-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/assignmentScheduleInstances", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ASSIGNMENT_INSTANCE_FIELDS,
+        access: "D/A PrivilegedAssignmentSchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
+        note: "Provisioned assignment windows; PIM for Groups needs P2 or ID Governance; lists require $filter on groupId or principalId.",
+        sources: ["https://learn.microsoft.com/graph/api/privilegedaccessgroup-list-assignmentscheduleinstances?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_ASSIGNMENT_INSTANCE_FIELDS,
+        access: "D/A PrivilegedAssignmentSchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
+        note: "PIM for Groups needs P2 or ID Governance.",
+        sources: ["https://learn.microsoft.com/graph/api/privilegedaccessgroupassignmentscheduleinstance-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/eligibilitySchedules", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ELIGIBILITY_SCHEDULE_FIELDS,
+        access: "D/A PrivilegedEligibilitySchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
+        note: "Eligibility schedules govern who may activate; PIM for Groups needs P2 or ID Governance; lists require $filter on groupId or principalId.",
+        sources: ["https://learn.microsoft.com/graph/api/privilegedaccessgroup-list-eligibilityschedules?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_ELIGIBILITY_SCHEDULE_FIELDS,
+        access: "D/A PrivilegedEligibilitySchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
+        note: "PIM for Groups needs P2 or ID Governance.",
+        sources: ["https://learn.microsoft.com/graph/api/privilegedaccessgroupeligibilityschedule-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ELIGIBILITY_INSTANCE_FIELDS,
+        access: "D/A PrivilegedEligibilitySchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
+        note: "Provisioned eligibility windows; PIM for Groups needs P2 or ID Governance; lists require $filter on groupId or principalId.",
+        sources: ["https://learn.microsoft.com/graph/api/privilegedaccessgroup-list-eligibilityscheduleinstances?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_ELIGIBILITY_INSTANCE_FIELDS,
+        access: "D/A PrivilegedEligibilitySchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
+        note: "PIM for Groups needs P2 or ID Governance.",
+        sources: ["https://learn.microsoft.com/graph/api/privilegedaccessgroupeligibilityscheduleinstance-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleRequests", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_ELIGIBILITY_REQUEST_FIELDS,
+        access: "D/A PrivilegedEligibilitySchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
+        note: "Eligibility asks plus outcomes; justification text rides only behind an explicit $select; PIM for Groups needs P2 or ID Governance; lists require $filter on groupId or principalId.",
+        sources: ["https://learn.microsoft.com/graph/api/privilegedaccessgroup-list-eligibilityschedulerequests?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_ELIGIBILITY_REQUEST_FIELDS,
+        access: "D/A PrivilegedEligibilitySchedule.Read.AzureADGroup. Delegated callers pass it as --scopes.",
+        note: "PIM for Groups needs P2 or ID Governance.",
+        sources: ["https://learn.microsoft.com/graph/api/privilegedaccessgroupeligibilityschedulerequest-get?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/devices", kind: "collection", query: COLLECTION_QUERY, fields: DEVICE_FIELDS,
         access: "D/A Device.Read.All. Delegated callers pass it as --scopes.",
         note: "Directory-device scope only; Intune device management is a separately authorized surface.",
@@ -551,6 +737,41 @@ export const REVIEWED_ROUTES = [
         access: "D/A User.Export.All plus User.Read.All. Delegated callers pass both as --scopes; delegated access additionally needs Company Administrator, the privileged role documented for export reads; personal Microsoft accounts are not supported. No P1/P2 prerequisite is stated for this read.",
         note: "storageLocation always renders as the redaction marker: export blob URLs and signed links never reach output. Workforce context only; export submission belongs to no read slice.",
         sources: ["https://learn.microsoft.com/graph/api/datapolicyoperation-get?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/datapolicyoperation?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/riskPrevention/fraudProtectionProviders", kind: "collection", query: ["$select"], fields: KNOWN_FRAUD_FIELDS, keepODataType: true,
+        access: "D RiskPreventionProviders.Read.All (RiskPreventionProviders.ReadWrite.All is the documented higher-privileged alternative). Delegated callers pass it as --scopes; delegated access additionally needs a directory role that can read risk-prevention configuration (Security Reader is the least-privileged read-only role); personal Microsoft accounts are not supported and Graph documents no supported application permission, so application profiles are refused before credentials. No P1/P2 prerequisite is stated for these reads.",
+        delegatedOnly: true,
+        note: "Graph documents $select only on the fraud-protection-provider list; $filter is not reviewed here. Arkose privateKey/publicKey and HUMAN serverToken are never projected: the first two are key material and the server token authenticates HUMAN API calls. Workforce context only; external-customer user flows and provisioning stay scheduled.",
+        sources: ["https://learn.microsoft.com/graph/api/riskpreventioncontainer-list-fraudprotectionproviders?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/fraudprotectionprovider?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/arkosefraudprotectionprovider?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/humansecurityfraudprotectionprovider?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/riskPrevention/fraudProtectionProviders/{fraudProtectionProvider-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_FRAUD_FIELDS, keepODataType: true,
+        access: "D RiskPreventionProviders.Read.All (RiskPreventionProviders.ReadWrite.All is the documented higher-privileged alternative). Delegated callers pass it as --scopes; delegated access additionally needs a directory role that can read risk-prevention configuration (Security Reader is the least-privileged read-only role); personal Microsoft accounts are not supported and Graph documents no supported application permission, so application profiles are refused before credentials. No P1/P2 prerequisite is stated for this read.",
+        delegatedOnly: true,
+        note: "Arkose privateKey/publicKey and HUMAN serverToken are never projected: the first two are key material and the server token authenticates HUMAN API calls. Workforce context only; external-customer user flows and provisioning stay scheduled.",
+        sources: ["https://learn.microsoft.com/graph/api/fraudprotectionprovider-get?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/fraudprotectionprovider?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/arkosefraudprotectionprovider?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/humansecurityfraudprotectionprovider?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/riskPrevention/webApplicationFirewallProviders", kind: "collection", query: ["$select", "$filter"], fields: KNOWN_WAF_FIELDS, keepODataType: true,
+        access: "D RiskPreventionProviders.Read.All (RiskPreventionProviders.ReadWrite.All is the documented higher-privileged alternative). Delegated callers pass it as --scopes; delegated access additionally needs a directory role that can read risk-prevention configuration (Security Reader is the least-privileged read-only role); personal Microsoft accounts are not supported and Graph documents no supported application permission, so application profiles are refused before credentials. No P1/P2 prerequisite is stated for these reads.",
+        delegatedOnly: true,
+        note: "Filtering passes through as plain $filter with no $count or ConsistencyLevel contract. Akamai clientSecret/clientToken/accessToken and Cloudflare apiToken are never projected: all four authenticate provider APIs. Workforce context only; verification submission and external-customer user flows stay scheduled.",
+        sources: ["https://learn.microsoft.com/graph/api/riskpreventioncontainer-list-webapplicationfirewallproviders?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/webapplicationfirewallprovider?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/akamaiwebapplicationfirewallprovider?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/cloudflarewebapplicationfirewallprovider?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/riskPrevention/webApplicationFirewallProviders/{webApplicationFirewallProvider-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_WAF_FIELDS, keepODataType: true,
+        access: "D RiskPreventionProviders.Read.All (RiskPreventionProviders.ReadWrite.All is the documented higher-privileged alternative). Delegated callers pass it as --scopes; delegated access additionally needs a directory role that can read risk-prevention configuration (Security Reader is the least-privileged read-only role); personal Microsoft accounts are not supported and Graph documents no supported application permission, so application profiles are refused before credentials. No P1/P2 prerequisite is stated for this read.",
+        delegatedOnly: true,
+        note: "Akamai clientSecret/clientToken/accessToken and Cloudflare apiToken are never projected: all four authenticate provider APIs. Workforce context only; verification submission and external-customer user flows stay scheduled.",
+        sources: ["https://learn.microsoft.com/graph/api/webapplicationfirewallprovider-get?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/webapplicationfirewallprovider?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/akamaiwebapplicationfirewallprovider?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/cloudflarewebapplicationfirewallprovider?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/riskPrevention/webApplicationFirewallVerifications", kind: "collection", query: ["$select", "$filter"], fields: KNOWN_VERIFICATION_FIELDS,
+        access: "D RiskPreventionProviders.Read.All. Delegated callers pass it as --scopes; delegated access additionally needs a directory role that can read risk-prevention configuration (Security Reader is the least-privileged read-only role); personal Microsoft accounts are not supported and Graph documents no supported application permission, so application profiles are refused before credentials. No P1/P2 prerequisite is stated for these reads.",
+        delegatedOnly: true,
+        note: "Filtering passes through as plain $filter with no $count or ConsistencyLevel contract ($expand stays unreviewed). verificationResult and verifiedDetails ride whole as complex objects. Rows never carry provider detail: the provider navigation has its own sub-read. Workforce context only; verification submission stays scheduled.",
+        sources: ["https://learn.microsoft.com/graph/api/riskpreventioncontainer-list-webapplicationfirewallverifications?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/webapplicationfirewallverificationmodel?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/riskPrevention/webApplicationFirewallVerifications/{webApplicationFirewallVerificationModel-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_VERIFICATION_FIELDS,
+        access: "D RiskPreventionProviders.Read.All (RiskPreventionProviders.ReadWrite.All is the documented higher-privileged alternative). Delegated callers pass it as --scopes; delegated access additionally needs a directory role that can read risk-prevention configuration (Security Reader is the least-privileged read-only role); personal Microsoft accounts are not supported and Graph documents no supported application permission, so application profiles are refused before credentials. No P1/P2 prerequisite is stated for this read.",
+        delegatedOnly: true,
+        note: "The get documents $expand only; $select is reviewed here as baseline single-resource support and $expand stays unreviewed. verificationResult and verifiedDetails ride whole as complex objects. The row never carries provider detail: the provider navigation has its own sub-read. Workforce context only; verification submission stays scheduled.",
+        sources: ["https://learn.microsoft.com/graph/api/webapplicationfirewallverificationmodel-get?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/webapplicationfirewallverificationmodel?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identity/riskPrevention/webApplicationFirewallVerifications/{webApplicationFirewallVerificationModel-id}/provider", kind: "single", query: SINGLE_QUERY, fields: KNOWN_WAF_FIELDS, keepODataType: true,
+        access: "D RiskPreventionProviders.Read.All (RiskPreventionProviders.ReadWrite.All is the documented higher-privileged alternative). Delegated callers pass it as --scopes; delegated access additionally needs a directory role that can read risk-prevention configuration (Security Reader is the least-privileged read-only role); personal Microsoft accounts are not supported and Graph documents no supported application permission, so application profiles are refused before credentials. No P1/P2 prerequisite is stated for this read.",
+        delegatedOnly: true,
+        note: "No provider-navigation operation page exists; access follows the WAF provider-get contract and the verificationModel resource reference. Akamai clientSecret/clientToken/accessToken and Cloudflare apiToken are never projected: all four authenticate provider APIs. Workforce context only.",
+        sources: ["https://learn.microsoft.com/graph/api/webapplicationfirewallprovider-get?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/webapplicationfirewallverificationmodel?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/webapplicationfirewallprovider?view=graph-rest-1.0"] },
     { id: "v1.0:GET:/identityGovernance/accessReviews/definitions", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_DEFINITION_FIELDS,
         access: "D/A AccessReview.Read.All. Delegated callers pass it as --scopes; delegated access additionally needs a supported Entra role (group/app reviews: review creator, Global Reader, Security Reader, User Administrator, Identity Governance Administrator or Security Administrator; Entra-role reviews: Security Reader, Identity Governance Administrator, Privileged Role Administrator or Security Administrator); personal Microsoft accounts are not supported.",
         note: "Definitions are review schedules (a series), never their occurrences; access reviews need P2 or ID Governance depending on capability.",
@@ -690,6 +911,30 @@ export const REVIEWED_ROUTES = [
         access: "D/A LifecycleWorkflows-Reports.Read.All (LifecycleWorkflows.Read.All or LifecycleWorkflows.ReadWrite.All for richer detail). Delegated callers pass one as --scopes; delegated access additionally needs Global Reader or Lifecycle Workflows Administrator; personal Microsoft accounts are not supported.",
         note: "No taskReport-nested operation page exists; access follows the taskReports list contract with the top-level taskdefinition-get contract (which documents LifecycleWorkflows.Read.All for its own route) and the taskDefinition resource reference. No query parameters are reviewed here, so whole rows arrive and are projected locally. Lifecycle workflows need Microsoft Entra ID Governance or Microsoft Entra Suite.",
         sources: ["https://learn.microsoft.com/graph/api/identitygovernance-workflow-list-taskreports?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/identitygovernance-taskdefinition-get?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_USER_PROCESSING_FIELDS,
+        access: "D/A LifecycleWorkflows-Reports.Read.All (LifecycleWorkflows.Read.All or LifecycleWorkflows.ReadWrite.All for richer detail). Delegated callers pass one as --scopes; delegated access additionally needs Global Reader or Lifecycle Workflows Administrator; personal Microsoft accounts are not supported.",
+        note: "Filtering passes through as plain $filter with no $count or ConsistencyLevel contract ($search/$orderby/$expand stay unreviewed). Run user processing results are personal data: defaults carry status and counts only and the subject link needs $expand and stays out. Lifecycle workflows need Microsoft Entra ID Governance or Microsoft Entra Suite.",
+        sources: ["https://learn.microsoft.com/graph/api/identitygovernance-run-list-userprocessingresults?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/userProcessingResults/{userProcessingResult-id}", kind: "single", query: SINGLE_QUERY, fields: KNOWN_USER_PROCESSING_FIELDS,
+        access: "D/A LifecycleWorkflows-Reports.Read.All (LifecycleWorkflows.Read.All or LifecycleWorkflows.ReadWrite.All for richer detail). Delegated callers pass one as --scopes; delegated access additionally needs Global Reader or Lifecycle Workflows Administrator; personal Microsoft accounts are not supported.",
+        note: "The userprocessingresult-get page covers this run-nested single directly. Run user processing results are personal data: defaults carry status and counts only and the subject link stays out. Lifecycle workflows need Microsoft Entra ID Governance or Microsoft Entra Suite.",
+        sources: ["https://learn.microsoft.com/graph/api/identitygovernance-userprocessingresult-get?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/identitygovernance-userprocessingresult?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults", kind: "collection", query: ["$filter"], fields: KNOWN_SUBJECT_PROCESSING_FIELDS,
+        access: "D/A LifecycleWorkflows-Reports.Read.All (LifecycleWorkflows.Read.All or LifecycleWorkflows.ReadWrite.All for richer detail). Delegated callers pass one as --scopes; delegated access additionally needs Global Reader or Lifecycle Workflows Administrator; personal Microsoft accounts are not supported.",
+        note: "Graph documents $count/$filter/$orderby/$expand but not $select here, so only $filter is reviewed and rows arrive whole. Run subject processing results are personal data: defaults carry subject type, status and counts only and the subject navigation stays out. Lifecycle workflows need Microsoft Entra ID Governance or Microsoft Entra Suite.",
+        sources: ["https://learn.microsoft.com/graph/api/identitygovernance-run-list-subjectprocessingresults?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/identitygovernance-subjectprocessingresult?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/subjectProcessingResults/{subjectProcessingResult-id}", kind: "single", query: [], fields: KNOWN_SUBJECT_PROCESSING_FIELDS,
+        access: "D/A LifecycleWorkflows-Reports.Read.All (LifecycleWorkflows.Read.All or LifecycleWorkflows.ReadWrite.All for richer detail). Delegated callers pass one as --scopes; delegated access additionally needs Global Reader or Lifecycle Workflows Administrator; personal Microsoft accounts are not supported.",
+        note: "The subjectprocessingresult-get page covers this run-nested single directly and documents $expand only, so whole rows are reviewed here and the subject navigation stays out. Run subject processing results are personal data: defaults carry subject type, status and counts only. Lifecycle workflows need Microsoft Entra ID Governance or Microsoft Entra Suite.",
+        sources: ["https://learn.microsoft.com/graph/api/identitygovernance-subjectprocessingresult-get?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/identitygovernance-subjectprocessingresult?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults", kind: "collection", query: COLLECTION_QUERY, fields: KNOWN_TASK_PROCESSING_FIELDS,
+        access: "D/A LifecycleWorkflows-Reports.Read.All (LifecycleWorkflows.Read.All or LifecycleWorkflows.ReadWrite.All for richer detail). Delegated callers pass one as --scopes; delegated access additionally needs Global Reader or Lifecycle Workflows Administrator; personal Microsoft accounts are not supported.",
+        note: "Filtering passes through as plain $filter with no $count or ConsistencyLevel contract ($search/$orderby/$expand stay unreviewed). Run task processing results carry one task's outcome with failure detail; the subject, task and workflowSubject navigations need $expand and stay out. Lifecycle workflows need Microsoft Entra ID Governance or Microsoft Entra Suite.",
+        sources: ["https://learn.microsoft.com/graph/api/identitygovernance-run-list-taskprocessingresults?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/identitygovernance-taskprocessingresult?view=graph-rest-1.0"] },
+    { id: "v1.0:GET:/identityGovernance/lifecycleWorkflows/workflows/{workflow-id}/runs/{run-id}/taskProcessingResults/{taskProcessingResult-id}", kind: "single", query: [], fields: KNOWN_TASK_PROCESSING_FIELDS,
+        access: "D/A LifecycleWorkflows-Reports.Read.All (LifecycleWorkflows.Read.All or LifecycleWorkflows.ReadWrite.All for richer detail). Delegated callers pass one as --scopes; delegated access additionally needs Global Reader or Lifecycle Workflows Administrator; personal Microsoft accounts are not supported.",
+        note: "No operation-level get page exists; access follows the run task-list contract and the taskProcessingResult resource reference. No query parameters are reviewed here, so whole rows arrive and are projected locally; the subject, task and workflowSubject navigations stay out. Lifecycle workflows need Microsoft Entra ID Governance or Microsoft Entra Suite.",
+        sources: ["https://learn.microsoft.com/graph/api/identitygovernance-run-list-taskprocessingresults?view=graph-rest-1.0", "https://learn.microsoft.com/graph/api/resources/identitygovernance-taskprocessingresult?view=graph-rest-1.0"] },
 ];
 function splitPath(path) {
     return path.split("/").filter(segment => segment.length > 0);
@@ -814,9 +1059,9 @@ function reviewedFields(route, value) {
         kept["@odata.type"] = value["@odata.type"];
     return kept;
 }
-// String truncation at the output boundary, mirroring az-axi's 4000-char
-// convention. --full disables truncation; redaction already ran in the
-// session and row caps are unaffected. Plain objects and arrays only.
+// String truncation at the output boundary, matching the 500-char rule used
+// by every Entra command. --full disables truncation; redaction already ran
+// in the session and row caps are unaffected. Plain objects and arrays only.
 function truncateForOutput(value, full) {
     if (typeof value === "string") {
         if (full || value.length <= TRUNCATE_AT)
@@ -924,7 +1169,7 @@ export async function runApiGet(args, deps) {
         const body = await session.execute({ profile: args.profile, operation, params, query, scopes });
         const shaped = truncateForOutput(reviewedFields(outputRoute, body), full);
         const record = isRecord(shaped.value) ? shaped.value : { value: shaped.value };
-        return shaped.truncated ? { ...record, help: ["Strings truncated at 4000 chars; re-run with --full"] } : record;
+        return shaped.truncated ? { ...record, help: ["Strings truncated at 500 chars; re-run with --full"] } : record;
     }
     const collected = await session.collect({ profile: args.profile, operation, params, query, scopes, limit: args.limit, cursor: args.cursor });
     const shaped = truncateForOutput(collected.value.map(row => reviewedFields(outputRoute, row)), full);
@@ -932,11 +1177,11 @@ export async function runApiGet(args, deps) {
     const warnings = route.warning ? { warnings: [route.warning] } : {};
     if (collected.complete) {
         return shaped.truncated
-            ? { returned: value.length, complete: true, value, ...warnings, help: ["Strings truncated at 4000 chars; re-run with --full"] }
+            ? { returned: value.length, complete: true, value, ...warnings, help: ["Strings truncated at 500 chars; re-run with --full"] }
             : { returned: value.length, complete: true, value, ...warnings };
     }
     const hint = "Resume the same path, profile and scopes with --cursor - and supply the cursor token on stdin; use --limit <rows> or --all";
-    const help = shaped.truncated ? [hint, "Strings truncated at 4000 chars; re-run with --full"] : [hint];
+    const help = shaped.truncated ? [hint, "Strings truncated at 500 chars; re-run with --full"] : [hint];
     return { returned: value.length, complete: false, reason: collected.reason, value, ...warnings, cursor: collected.cursor, help };
 }
 // Minimal HTTPS transport: sends only what the session authorized (GET on the

package/dist/bin/mg-axi-hook.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+// Session-start hook entry point: print the local-only ambient summary and
+// always exit 0 on config state, never loudly, so agent startup never breaks.
+// Unknown argv fails loud with exit 2 instead of a silent wrong summary.
+// Static imports are avoided so a broken install still reaches the fallback.
+const args = process.argv.slice(2);
+if (args.length === 1 && args[0] === "--help") {
+    process.stdout.write("mg-axi-hook: print the local-only mg-axi session-start summary (configured profiles, auth-cache presence, version)\nusage: mg-axi-hook [--help]\n");
+}
+else if (args.length > 0) {
+    try {
+        const { encode } = await import("@toon-format/toon");
+        process.stdout.write(`${encode({ error: `unexpected argument \`${args[0]}\` for \`mg-axi-hook\``, code: "VALIDATION_ERROR", help: ["Run `mg-axi-hook` with no arguments for the session summary"] })}\n`);
+    }
+    catch {
+        process.stdout.write(`error: unexpected argument \`${args[0]}\` for \`mg-axi-hook\`\n`);
+    }
+    process.exitCode = 2;
+}
+else {
+    try {
+        const { VERSION } = await import("../version.js").catch(() => ({ VERSION: "unknown" }));
+        const { hookSummary } = await import("../hook.js");
+        process.stdout.write(await hookSummary({ version: VERSION }));
+    }
+    catch {
+        process.stdout.write("mg: status unavailable\n");
+    }
+    process.exitCode = 0;
+}
+export {};