genesys v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-genesys-client-credentials-token

Custody

customer_vault

Injection

header (Authorization)

An OAuth 2.0 access token obtained with the client credentials grant for the customer's Genesys Cloud org, held in the client's own secret manager. TOKEN ISSUANCE IS EXTERNAL: an administrator creates an OAuth client with the Client Credentials grant under Admin > Integrations > OAuth and assigns it roles; an external deployment process exchanges that client's id and secret at the region's login host for an access token and stores the result. The stored material must be the complete Authorization header value (scheme included): 'Bearer ' followed by the access token. The executor injects the stored value verbatim and performs no token lifecycle itself; the Genesys SDK's helper (AuthorizeClientCredentials) is what a custody job would use, not the executor. Access tokens expire, so the reference must be refreshed by the deployment's custody job; an expired value fails closed. Revocation honesty: disabling or deleting the OAuth client stops new token issuance, but the retrieved material does not establish whether already-issued access tokens are revoked at that moment — treat an already-issued token as valid until its expiry unless the deployment verifies revocation against Genesys, and review that behavior before enabling. Least privilege: a client-credentials token acts with exactly the roles assigned to the OAuth client, so assign the client the minimum roles (and division scoping) that make these capabilities work and nothing more. SECOND REFERENCE — user context: genesys.conversations.read and genesys.conversations.calls.create override this pack-level reference with secret-ref-genesys-user-context-token, because the retrieved vendor-generated SDK documentation scopes GET /api/v2/conversations to the logged-in user's active conversations and POST /api/v2/conversations/calls creates a call conversation in user context — neither is made usable by assigning more roles to a client-credentials token. That reference likewise stores ONE exact value, the complete header value 'Bearer <access_token>', minted externally through a user-context OAuth grant (for example the authorization code or implicit grant at the region's login host) for a dedicated user; an external custody job runs the grant and any refresh, and the HTTP injector injects the stored value verbatim. The call capability additionally depends on station and session prerequisites the platform places on the user (an assigned, provisioned station and an active session) — review those prerequisites against Genesys documentation before enabling. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• genesys-org-users (api, pii): https://genesys-cloud.invalid/api/v2/users
• genesys-org-conversations (api, pii): https://genesys-cloud.invalid/api/v2/conversations
• genesys-org-routing (api, internal): https://genesys-cloud.invalid/api/v2/routing/queues

DRAFT — verification limits a reviewer must weigh. The Genesys Cloud Developer Center (developer.genesys.cloud) is a JavaScript application that did not yield extractable reference text at review time, and the public Platform API v2 swagger URL probed during review (the api host's /api/v2/docs/swagger.json) returned 404; this pack was therefore scaffolded from Genesys's official platform client SDK repositories, which Genesys generates from the public Platform API v2 swagger, and from the published Go package documentation of that SDK. Endpoint paths here are the canonical /api/v2 paths that swagger defines; re-verify each path against the Developer Center API Explorer before enabling. The endpoint host 'genesys-cloud.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): Genesys Cloud hosts are region-specific (the official SDK documents base paths such as https://api.mypurecloud.com, https://api.mypurecloud.jp and per-region login hosts for token issuance), so substitute the customer's regional API host before enabling, in every endpoint, in the resource locators and in every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. TOKEN ISSUANCE IS EXTERNAL: an external deployment process exchanges the OAuth client's client id and client secret at the region's login host for an access token and stores and renews the complete header value described in the credential note; storing the client credentials themselves under the reference does not make the HTTP injector perform OAuth — the injector injects the stored value verbatim. Tiering rationale: conversations.calls.create places a live outbound voice call to an end recipient — a message delivered to a person — so it is registered as create and send at the R3 floor; send is one of the IRREVERSIBLE ACTIONS (delete, send, pay, deploy, approve, share and transfer). The analytics capability registers as read even though the vendor method is POST: the Genesys analytics query endpoints accept a query body and return data without mutating state, so the governed effect is a read. Documented exclusions — this pack does not register: authorization administration (creating roles or divisions, assigning roles to users — privilege-granting mutations of the access-control plane itself); OAuth client management (creating or deleting the very clients that mint tokens); Architect flow publishing and check-in (a deploy of routing logic to production); conversation recording deletions and recording-policy changes (erasure of compliance records); telephony and trunk configuration; organization and WFM administration; external-contacts bulk import and bulk delete; and the notification/WebSocket channels — each is a different registration requiring its own review, and none is approximated here.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://github.com/MyPureCloud/platform-client-sdk-go (retrieved 2026-09-21)
• https://pkg.go.dev/github.com/mypurecloud/platform-client-sdk-go/v157/platformclientv2 (retrieved 2026-09-21)
• https://raw.githubusercontent.com/MyPureCloud/platform-client-sdk-go/master/platformclientv2/conversationsapi.go (retrieved 2026-09-21)
• https://raw.githubusercontent.com/MyPureCloud/platform-client-sdk-go/master/platformclientv2/routingapi.go (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.