Skip to content

Action Catalog

Every authorized gateway route carries a stable action name of the form <domain>:<verb>, declared at the route-registration site (ADR 0024). Action names are what a deployment's roles file references in per-role allow/deny lists to refine a role's effective action set beyond its permission tiers, and what the entitlements endpoint reports to the UI.

Action names are a product contract, exactly like the permission vocabulary: they change only via product releases, renaming or removing one is a breaking configuration change for deployments whose policy documents reference it, and new actions are always announced in release notes. Several routes may share one action when they perform the same domain action. A route never carries more than one action name.

The default tier column is the permission each action's routes are pinned to when no policy refines it (the shipped behavior of the plain tier model). Unauthenticated and structural routes (login, session resolution, health probes, page templates, the live-feed sockets) carry no action name and can never be policy targets. See the REST API reference for the full route table.

MES integration identities are structurally confined to the /api/v1/mes/ routes (MES fence). Only the actions those routes carry resolve for such an identity. The rest are refused whatever the tiers or a policy allow list say, and neither dcs auth policy nor the entitlements endpoint reports them as reachable.

Actions

Action Default tier Routes
alarm:acknowledge operate POST /api/v1/sites/{site}/alarms/{name}/acknowledge
alarm:delete engineer DELETE /api/v1/sites/{site}/alarms/{name}
alarm:list read GET /api/v1/sites/{site}/alarms
alarm:read read GET /api/v1/sites/{site}/alarms/{name}
alarm:shelve operate POST /api/v1/sites/{site}/alarms/{name}/shelve
alarm:unshelve operate POST /api/v1/sites/{site}/alarms/{name}/unshelve
alarmdefinition:create engineer POST /api/v1/sites/{site}/alarmdefinitions
alarmdefinition:delete engineer DELETE /api/v1/sites/{site}/alarmdefinitions/{name}
alarmdefinition:list read GET /api/v1/sites/{site}/alarmdefinitions
alarmdefinition:read read GET /api/v1/sites/{site}/alarmdefinitions/{name}
alarmdefinition:update engineer PUT /api/v1/sites/{site}/alarmdefinitions/{name}
apikey:create admin POST /api/v1/mes/apikeys
apikey:delete admin DELETE /api/v1/mes/apikeys/{name}
apikey:list admin GET /api/v1/mes/apikeys
archive-integrity:run admin POST /api/v1/audit/archive-integrity/run
area:create engineer POST /api/v1/sites/{site}/areas
area:delete engineer DELETE /api/v1/sites/{site}/areas/{name}
area:list read GET /api/v1/sites/{site}/areas
area:read read GET /api/v1/sites/{site}/areas/{name}
area:update engineer PUT /api/v1/sites/{site}/areas/{name}
audit:read read GET /api/v1/audit
GET /api/v1/sites/{site}/audit
GET /api/v1/sites/{site}/audit/{name}
GET /api/v1/sites/{site}/audit/correlation/{correlationID}
GET /api/v1/audit/archive-integrity/latest
GET /api/v1/audit/archive-integrity/history
audit:verify supervise GET /api/v1/audit/verify
GET /api/v1/audit/verify-archived
backup:export admin GET /api/v1/backup/crds
backup:export-audit admin GET /api/v1/backup/audit
batch:create operate POST /api/v1/sites/{site}/batches
batch:delete engineer DELETE /api/v1/sites/{site}/batches/{name}
batch:list read GET /api/v1/sites/{site}/batches
batch:preflight read POST /api/v1/sites/{site}/batches/preflight
batch:read read GET /api/v1/sites/{site}/batches/{name}
GET /api/v1/sites/{site}/batches/{name}/events
GET /api/v1/sites/{site}/batches/{name}/messages
GET /api/v1/sites/{site}/batches/{name}/timeline
GET /api/v1/sites/{site}/batches/{name}/record
batch:update operate PUT /api/v1/sites/{site}/batches/{name}
batchrecord:comment supervise POST /api/v1/sites/{site}/batchrecords/{name}/comments
batchrecord:finalize supervise POST /api/v1/sites/{site}/batchrecords/{name}/finalize
batchrecord:list read GET /api/v1/sites/{site}/batchrecords
batchrecord:read read GET /api/v1/sites/{site}/batchrecords/{name}
batchrecord:review supervise POST /api/v1/sites/{site}/batchrecords/{name}/review
blocktype:list read GET /api/v1/blocktypes
blocktype:read read GET /api/v1/blocktypes/{name}
changecontrol:read read GET /api/v1/sites/{site}/change-control/history
changecontrol:verify supervise GET /api/v1/change-control/verify
changerequest:approve supervise POST /api/v1/changerequests/{namespace}/{name}/approve
changerequest:create engineer POST /api/v1/sites/{site}/changerequests
changerequest:list read GET /api/v1/changerequests
changerequest:read read GET /api/v1/system/changerequest-backends
GET /api/v1/changerequests/{namespace}/{name}
changerequest:reject supervise POST /api/v1/changerequests/{namespace}/{name}/reject
changerequest:withdraw engineer POST /api/v1/changerequests/{namespace}/{name}/withdraw
command:send operate POST /api/v1/sites/{site}/command
controller:create admin POST /api/v1/sites/{site}/controllers
controller:delete admin DELETE /api/v1/sites/{site}/controllers/{name}
controller:list read GET /api/v1/sites/{site}/controllers
controller:read read GET /api/v1/sites/{site}/controllers/{name}
controller:update admin PUT /api/v1/sites/{site}/controllers/{name}
controllogic:transform engineer POST /api/v1/control-logic/to-st
POST /api/v1/control-logic/to-network
controllogic:validate engineer POST /api/v1/validate/st
POST /api/v1/validate/sfc-chart
controlmodule:create engineer POST /api/v1/sites/{site}/controlmodules
controlmodule:delete engineer DELETE /api/v1/sites/{site}/controlmodules/{name}
controlmodule:list read GET /api/v1/sites/{site}/controlmodules
controlmodule:read read GET /api/v1/sites/{site}/controlmodules/{name}
controlmodule:read-tag read GET /api/v1/sites/{site}/controlmodules/{cm}/tags
GET /api/v1/sites/{site}/controlmodules/{cm}/tags/{tag}
controlmodule:update engineer PUT /api/v1/sites/{site}/controlmodules/{name}
controlmodule:write-tag operate POST /api/v1/sites/{site}/controlmodules/{cm}/tags/{tag}
controlmoduletemplate:create engineer POST /api/v1/controlmoduletemplates
controlmoduletemplate:delete engineer DELETE /api/v1/controlmoduletemplates/{name}
controlmoduletemplate:list read GET /api/v1/controlmoduletemplates
controlmoduletemplate:read read GET /api/v1/controlmoduletemplates/{name}
controlmoduletemplate:update engineer PUT /api/v1/controlmoduletemplates/{name}
controlprogram:create engineer POST /api/v1/sites/{site}/fbnetworks
controlprogram:delete engineer DELETE /api/v1/sites/{site}/fbnetworks/{name}
controlprogram:list read GET /api/v1/sites/{site}/fbnetworks
controlprogram:override-hot-swap engineer POST /api/v1/sites/{site}/fbnetworks/{name}/override-hot-swap
controlprogram:read read GET /api/v1/sites/{site}/fbnetworks/{name}
controlprogram:update engineer PUT /api/v1/sites/{site}/fbnetworks/{name}
controlrecipe:delete engineer DELETE /api/v1/sites/{site}/recipes/control/{name}
controlrecipe:list read GET /api/v1/sites/{site}/recipes/control
controlrecipe:read read GET /api/v1/sites/{site}/recipes/control/{name}
demo:provision read POST /api/v1/demo/provision
demo:read read GET /api/v1/demo/status
discovery:browse engineer POST /api/v1/discovery/opcua/endpoints
POST /api/v1/discovery/opcua/browse
POST /api/v1/discovery/opcua/search
POST /api/v1/discovery/opcua/variables
POST /api/v1/discovery/opcua/services
POST /api/v1/discovery/opcua/read
POST /api/v1/discovery/opcua/method-args
GET /api/v1/discovery/opcua/client-identity
discovery:write engineer POST /api/v1/discovery/opcua/write
enterprise:create engineer POST /api/v1/enterprises
enterprise:delete engineer DELETE /api/v1/enterprises/{name}
enterprise:list read GET /api/v1/enterprises
enterprise:read read GET /api/v1/enterprises/{name}
enterprise:update engineer PUT /api/v1/enterprises/{name}
formula:create engineer POST /api/v1/sites/{site}/recipes/master/{name}/formulas
formula:delete engineer DELETE /api/v1/sites/{site}/recipes/master/{name}/formulas/{formulaName}
formula:list read GET /api/v1/formulas
GET /api/v1/sites/{site}/recipes/master/{name}/formulas
formula:read read GET /api/v1/sites/{site}/recipes/master/{name}/formulas/{formulaName}
formula:update engineer PUT /api/v1/sites/{site}/recipes/master/{name}/formulas/{formulaName}
functionblocktype:create engineer POST /api/v1/fbblocktypes
functionblocktype:delete engineer DELETE /api/v1/fbblocktypes/{name}
functionblocktype:list read GET /api/v1/fbblocktypes
functionblocktype:read read GET /api/v1/fbblocktypes/{name}
functionblocktype:update engineer PUT /api/v1/fbblocktypes/{name}
historian:read read GET /api/v1/historian/status
GET /api/v1/historian/tags
GET /api/v1/historian/tags/distinct
GET /api/v1/historian/alarms
GET /api/v1/historian/states
GET /api/v1/historian/batch/{batchID}/tags
GET /api/v1/historian/batch/{batchID}/alarms
GET /api/v1/historian/batch/{batchID}/states
import:mtp engineer POST /api/v1/import/mtp
interlock:clear-bypass interlock:bypass DELETE /api/v1/sites/{site}/controlmodules/{cm}/interlock/bypass
interlock:set-bypass interlock:bypass POST /api/v1/sites/{site}/controlmodules/{cm}/interlock/bypass
iomodule:create admin POST /api/v1/sites/{site}/iomodules
iomodule:delete admin DELETE /api/v1/sites/{site}/iomodules/{name}
iomodule:discover admin POST /api/v1/sites/{site}/iomodules/{name}/discover
iomodule:list read GET /api/v1/sites/{site}/iomodules
iomodule:poll operate POST /api/v1/sites/{site}/iomodules/{name}/read
POST /api/v1/sites/{site}/iomodules/{name}/read-batch
iomodule:read read GET /api/v1/sites/{site}/iomodules/{name}
iomodule:read-tag read GET /api/v1/sites/{site}/iomodules/{name}/tags
GET /api/v1/sites/{site}/iomodules/{name}/tags/{channel...}
iomodule:release operate POST /api/v1/sites/{site}/iomodules/{name}/release
iomodule:update admin PUT /api/v1/sites/{site}/iomodules/{name}
iomodule:write operate POST /api/v1/sites/{site}/iomodules/{name}/write
lockout:clear admin DELETE /api/v1/auth/lockouts/{username}
lockout:list admin GET /api/v1/auth/lockouts
mes:create-work-order operate POST /api/v1/mes/sites/{site}/work-orders
mes:delete-work-order operate DELETE /api/v1/mes/sites/{site}/work-orders/{id}
mes:deliver-external-result operate POST /api/v1/mes/sites/{site}/phases/{name}/external-result
mes:read read GET /api/v1/mes/sites/{site}/product-definitions
GET /api/v1/mes/sites/{site}/product-definitions/{name}
GET /api/v1/mes/sites/{site}/production-capability
GET /api/v1/mes/sites/{site}/equipment/{name}/status
GET /api/v1/mes/sites/{site}/work-orders
GET /api/v1/mes/sites/{site}/work-orders/{id}
GET /api/v1/mes/sites/{site}/external-results/pending
GET /api/v1/mes/sites/{site}/production-performance
GET /api/v1/mes/sites/{site}/production-performance/{batchID}
mode:set operate POST /api/v1/sites/{site}/mode
operation:create engineer POST /api/v1/sites/{site}/operations
operation:delete engineer DELETE /api/v1/sites/{site}/operations/{name}
operation:execute operate-lead POST /api/v1/sites/{site}/units/{unit}/execute-operation
operation:list read GET /api/v1/sites/{site}/operations
operation:read read GET /api/v1/sites/{site}/operations/{name}
operation:update engineer PUT /api/v1/sites/{site}/operations/{name}
operationtemplate:create engineer POST /api/v1/sites/{site}/operationtemplates
operationtemplate:delete engineer DELETE /api/v1/sites/{site}/operationtemplates/{name}
operationtemplate:list read GET /api/v1/sites/{site}/operationtemplates
operationtemplate:read read GET /api/v1/sites/{site}/operationtemplates/{name}
operationtemplate:update engineer PUT /api/v1/sites/{site}/operationtemplates/{name}
overview:read read GET /api/v1/overview
GET /api/v1/sites/{site}/overview
phase:create engineer POST /api/v1/sites/{site}/phases
phase:delete engineer DELETE /api/v1/sites/{site}/phases/{name}
phase:execute operate POST /api/v1/sites/{site}/units/{unit}/execute-phase
phase:list read GET /api/v1/sites/{site}/phases
phase:read read GET /api/v1/sites/{site}/phases/{name}
phase:update engineer PUT /api/v1/sites/{site}/phases/{name}
phasetemplate:create engineer POST /api/v1/sites/{site}/phasetemplates
phasetemplate:delete engineer DELETE /api/v1/sites/{site}/phasetemplates/{name}
phasetemplate:list read GET /api/v1/sites/{site}/phasetemplates
phasetemplate:read read GET /api/v1/sites/{site}/phasetemplates/{name}
phasetemplate:update engineer PUT /api/v1/sites/{site}/phasetemplates/{name}
policy:read supervise GET /api/v1/auth/policy
procedure:create engineer POST /api/v1/sites/{site}/procedures
procedure:delete engineer DELETE /api/v1/sites/{site}/procedures/{name}
procedure:list read GET /api/v1/sites/{site}/procedures
procedure:read read GET /api/v1/sites/{site}/procedures/{name}
procedure:update engineer PUT /api/v1/sites/{site}/procedures/{name}
proceduretemplate:create engineer POST /api/v1/sites/{site}/proceduretemplates
proceduretemplate:delete engineer DELETE /api/v1/sites/{site}/proceduretemplates/{name}
proceduretemplate:list read GET /api/v1/sites/{site}/proceduretemplates
proceduretemplate:read read GET /api/v1/sites/{site}/proceduretemplates/{name}
proceduretemplate:update engineer PUT /api/v1/sites/{site}/proceduretemplates/{name}
processcell:create engineer POST /api/v1/sites/{site}/processcells
processcell:delete engineer DELETE /api/v1/sites/{site}/processcells/{name}
processcell:list read GET /api/v1/sites/{site}/processcells
processcell:read read GET /api/v1/sites/{site}/processcells/{name}
processcell:update engineer PUT /api/v1/sites/{site}/processcells/{name}
prompt:respond operate-lead POST /api/v1/sites/{site}/phases/{name}/prompt-response
qualify:record engineer POST /api/v1/qualify/iq/record
POST /api/v1/qualify/oq/record
POST /api/v1/qualify/pq/record
POST /api/v1/qualify/dr/record
qualify:snapshot engineer GET /api/v1/qualify/iq/snapshot
recipe:activate supervise POST /api/v1/sites/{site}/recipes/master/{name}/activate
recipe:approve supervise POST /api/v1/sites/{site}/recipes/master/{name}/approve
recipe:create engineer POST /api/v1/sites/{site}/recipes/master
recipe:delete engineer DELETE /api/v1/sites/{site}/recipes/master/{name}
recipe:list read GET /api/v1/sites/{site}/recipes/master
recipe:new-version engineer POST /api/v1/sites/{site}/recipes/master/{name}/new-version
recipe:read read GET /api/v1/sites/{site}/recipes/master/{name}/bindings
GET /api/v1/sites/{site}/recipes/master/{name}/revisions
GET /api/v1/sites/{site}/recipes/master/{name}/revisions/diff
GET /api/v1/sites/{site}/recipes/master/{name}/revisions/{revision}
GET /api/v1/sites/{site}/recipes/master/{name}
recipe:reject supervise POST /api/v1/sites/{site}/recipes/master/{name}/reject
recipe:release supervise POST /api/v1/sites/{site}/recipes/master/{name}/release
recipe:revert engineer POST /api/v1/sites/{site}/recipes/master/{name}/revisions/{revision}/revert
recipe:update engineer PUT /api/v1/sites/{site}/recipes/master/{name}
recipe:withdraw supervise POST /api/v1/sites/{site}/recipes/master/{name}/withdraw
resource:apply engineer POST /api/v1/apply
resource:export engineer GET /api/v1/export
runtime:diagnostics engineer GET /api/v1/sites/{site}/units/{name}/runtime/diagnostics
GET /api/v1/sites/{site}/units/{name}/runtime/programs
GET /api/v1/sites/{site}/units/{name}/runtime/events
GET /api/v1/sites/{site}/units/{name}/runtime/logs
runtime:poll operate POST /api/v1/sites/{site}/units/{name}/runtime/read
runtime:read read GET /api/v1/sites/{site}/units/{name}/runtime/status
GET /api/v1/sites/{site}/units/{name}/runtime/tags
GET /api/v1/sites/{site}/units/{name}/runtime/fbnetwork/{network}
runtime:restart engineer POST /api/v1/sites/{site}/units/{name}/runtime/restart
runtime:write operate POST /api/v1/sites/{site}/units/{name}/runtime/write
search:query read GET /api/v1/search
servers:cordon admin POST /api/v1/servers/{node}/cordon
servers:drain admin POST /api/v1/servers/{node}/drain
servers:maintenance-abandon admin POST /api/v1/servers/{node}/maintenance/abandon
servers:power-on admin POST /api/v1/servers/{node}/power-on
servers:read read GET /api/v1/servers
GET /api/v1/servers/{node}/preflight
GET /api/v1/servers/{node}/events
GET /api/v1/system/power-capabilities
GET /api/v1/servers/{node}/maintenance
GET /api/v1/servers/{node}/identity
servers:reboot admin POST /api/v1/servers/{node}/reboot
servers:set-display-name admin PUT /api/v1/servers/{node}/identity
servers:shutdown admin POST /api/v1/servers/{node}/shutdown
servers:uncordon admin POST /api/v1/servers/{node}/uncordon
session:list admin GET /api/v1/auth/sessions
session:terminate admin DELETE /api/v1/auth/sessions/{id}
signature:mint read POST /api/v1/signatures
simulationpreset:create engineer POST /api/v1/sites/{site}/simulationpresets
simulationpreset:delete engineer DELETE /api/v1/sites/{site}/simulationpresets/{name}
simulationpreset:list read GET /api/v1/sites/{site}/simulationpresets
simulationpreset:read read GET /api/v1/sites/{site}/simulationpresets/{name}
simulationpreset:seed engineer POST /api/v1/sites/{site}/simulationpresets/seed
simulationpreset:update engineer PUT /api/v1/sites/{site}/simulationpresets/{name}
site:create engineer POST /api/v1/sites
site:delete engineer DELETE /api/v1/sites/{site}
site:heal read POST /api/v1/admin/sites/{site}/heal
site:list read GET /api/v1/sites
site:outage admin POST /api/v1/sites/{site}/outage
site:outage-abandon admin POST /api/v1/sites/{site}/outage/abandon
site:outage-continue admin POST /api/v1/sites/{site}/outage/continue
site:outage-read read GET /api/v1/sites/{site}/outage
GET /api/v1/sites/{site}/outage/preflight
GET /api/v1/sites/{site}/return
site:read read GET /api/v1/sites/{site}
site:update engineer PUT /api/v1/sites/{site}
system:diagnostics engineer GET /api/v1/system/services/{component}/events
GET /api/v1/system/services/{component}/logs
system:health read GET /api/v1/system/health
system:service-restart engineer POST /api/v1/system/services/{component}/restart
system:service-run engineer POST /api/v1/system/services/{component}/run
tag:browse read GET /api/v1/sites/{site}/tags
GET /api/v1/sites/{site}/tags/browse
GET /api/v1/sites/{site}/units/{unit}/tags
tag:read read GET /api/v1/sites/{site}/units/{unit}/tags/{address...}
tag:write operate POST /api/v1/sites/{site}/units/{unit}/tags/{address...}
trace:read read GET /api/v1/sites/{site}/trace/lot/{lotID}/forward
GET /api/v1/sites/{site}/trace/lot/{lotID}/backward
GET /api/v1/sites/{site}/trace/batch/{name}/materials
GET /api/v1/sites/{site}/trace/genealogy/{lotID}
unit:create engineer POST /api/v1/sites/{site}/units
unit:delete engineer DELETE /api/v1/sites/{site}/units/{name}
unit:failover operate-lead POST /api/v1/sites/{site}/units/{name}/failover
unit:failover-targets operate-lead GET /api/v1/sites/{site}/units/{name}/failover/targets
unit:list read GET /api/v1/sites/{site}/units
unit:mtp-services read GET /api/v1/sites/{site}/units/{name}/mtp-services
unit:read read GET /api/v1/sites/{site}/units/{name}
GET /api/v1/sites/{site}/units/{name}/bindings
unit:update engineer PUT /api/v1/sites/{site}/units/{name}
unitprocedure:create engineer POST /api/v1/sites/{site}/unitprocedures
unitprocedure:delete engineer DELETE /api/v1/sites/{site}/unitprocedures/{name}
unitprocedure:execute operate-lead POST /api/v1/sites/{site}/units/{unit}/execute-unitprocedure
unitprocedure:list read GET /api/v1/sites/{site}/unitprocedures
unitprocedure:read read GET /api/v1/sites/{site}/unitprocedures/{name}
unitprocedure:update engineer PUT /api/v1/sites/{site}/unitprocedures/{name}
unitproceduretemplate:create engineer POST /api/v1/sites/{site}/unitproceduretemplates
unitproceduretemplate:delete engineer DELETE /api/v1/sites/{site}/unitproceduretemplates/{name}
unitproceduretemplate:list read GET /api/v1/sites/{site}/unitproceduretemplates
unitproceduretemplate:read read GET /api/v1/sites/{site}/unitproceduretemplates/{name}
unitproceduretemplate:update engineer PUT /api/v1/sites/{site}/unitproceduretemplates/{name}

231 actions over 297 routes, generated from internal/gateway/routes.go.