Genesys package v1.0.0

Store a complete 'Bearer <access_token>' header value in the client's secret manager. For the pack-level reference, an administrator creates a Client Credentials OAuth client under Admin > Integrations > OAuth and assigns minimal roles and divisions. An external process exchanges its ID and secret at the customer's regional login host, then stores and renews the token. The executor injects the value unchanged; AuthorizeClientCredentials is a Genesys SDK helper for that external process, not the executor.

Read the client's actual token duration. The documented range is 300–172,800 seconds (maximum two days, default 86,400). A client holding only the SCIM Integration role can extend it to 38,880,000 seconds (450 days). HIPAA-enabled organizations impose a 15-minute idle timeout on OAuth-client tokens. Refresh before expiry; an expired value fails closed.

Disabling or deleting the OAuth client stops new issuance, but the reviewed material does not establish immediate invalidation of existing tokens. The client-management documentation says clients under 30 days are deleted irreversibly, older clients deactivate for seven days, and applications using deleted credentials lose access. It does not establish the residual validity window for issued tokens. Treat them as valid until expiry unless the deployment verifies cut-off with Genesys; review that behavior before enabling.

Two capabilities need a separate reference, secret-ref-genesys-user-context-token: genesys.conversations.read and genesys.conversations.calls.create. These operations act in user context; more roles on a Client Credentials token do not supply it.

That reference stores the complete 'Bearer <access_token>' header minted externally through a user-context OAuth grant, such as authorization code or implicit, at the regional login host for a dedicated user. The external process owns the grant and refresh. Calls additionally require an assigned, provisioned station and an active user session; verify those platform prerequisites before enabling.

Keep each token only in executor memory for a call, never in logs, traces, diagnostics, or crash dumps. Do not enable the pack if the deployment cannot meet those requirements.

Review status: on 2026-09-23, every registered endpoint, method, operation ID, summary, and OAuth scope was checked against Genesys's first-party swagger reference. The API host's /api/v2/docs/swagger route redirects to Genesys's publicapi-v2-latest.json schema on its own public S3 host, the source used by the Developer Center's API explorer.

The pack was initially based on official SDK repositories because the JavaScript-only Developer Center reference could not be extracted, and the /api/v2/docs/swagger.json route returned 404. The later first-party schema review resolved that reference-access gap.

Deployment obligations, not review gaps: the owners are placeholders the deployment replaces with accountable humans, the reserved host below must be substituted before enabling, and the unverified token-revocation cut-off named in the credential note is a deployment-time verification item this pack claims nothing about.

The endpoint host 'genesys-cloud.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): Genesys Cloud hosts are region-specific (the official SDK documents base paths such as https://api.mypurecloud.com, https://api.mypurecloud.jp and per-region login hosts for token issuance), so substitute the customer's regional API host before enabling, in every endpoint, in the resource locators and in every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step.

External token issuance: an external deployment process exchanges the OAuth client's client id and client secret at the region's login host for an access token and stores and renews the complete header value described in the credential note; storing the client credentials themselves under the reference does not make the HTTP injector perform OAuth — the injector injects the stored value verbatim.

Approval classification: conversations.calls.create places a live outbound voice call to an end recipient — a message delivered to a person — so it is registered as create and send at the minimum R3 tier; send is one of the designated actions requiring human approval. The analytics capability registers as read even though the vendor method is POST: the Genesys analytics query endpoints accept a query body and return data without mutating state, so the governed effect is a read.

Documented exclusions — this pack does not register: authorization administration (creating roles or divisions, assigning roles to users — privilege-granting mutations of the access-control plane itself); OAuth client management (creating or deleting the very clients that mint tokens); Architect flow publishing and check-in (a deploy of routing logic to production); conversation recording deletions and recording-policy changes (erasure of compliance records); telephony and trunk configuration; organization and WFM administration; external-contacts bulk import and bulk delete; and the notification/WebSocket channels — each is a different registration requiring its own review, and none is approximated here.