Beta module namespace
accessmap
Beta routes may change with notice and are NOT covered by the 24-month stable window of the core contract.
Every module route is enumerated with method, path, auth and required permission; request/response schemas are not published for the beta surface.
7 operations
| Method | Path | Required permission | Authentication | Summary |
|---|---|---|---|---|
| get | /v1/m/accessmap/attack-paths/escalation | accessmap:graph:read | Bearer token | Lists the chains by which one agent shares a resource with another agent that holds more write access. |
| get | /v1/m/accessmap/attack-paths/exfil | accessmap:graph:read | Bearer token | Lists the routes by which data in one resource could leave: the agents that reach it and each other resource they can write. |
| get | /v1/m/accessmap/attack-paths/reachability | accessmap:graph:read | Bearer token | Lists the resources one agent can reach through its access edges, one path per resource, with the weakest attribution along each path. |
| get | /v1/m/accessmap/attack-paths/summary | accessmap:graph:read | Bearer token | Counts the estate's agents, edges, escalation chains and exfil routes out of resources that carry a sensitivity, plus its critical agents and sensitive targets. |
| get | /v1/m/accessmap/drift | accessmap:drift:read | Bearer token | Returns the permitted-vs-observed least-privilege drift: unexpected accesses (observed, not permitted — the headline) and unused grants. |
| get | /v1/m/accessmap/graph | accessmap:graph:read | Bearer token | Returns the R/RW graph as a React Flow node+edge contract, filtered by any of the supported edge columns. |
| get | /v1/m/accessmap/neighbors | accessmap:graph:read | Bearer token | Returns the edges touching one node (id required) in a direction (outgoing|incoming|both, default both), as the same node+edge contract. |