{
  "schema": "aaes/capability-pack/1",
  "provider": "mongodb",
  "version": "1.0.0",
  "description": "Read MongoDB Atlas projects, clusters, database users, and network access lists; create clusters and users, update or pause clusters, terminate clusters, and add network access. Cluster updates can change billable infrastructure; pausing can delete Search Node data.",
  "notes": "The endpoint host 'mongodb-atlas.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the Atlas Administration API host the deployment actually uses (the documented base URL is https://cloud.mongodb.com/api/atlas/v2) before enabling, in every endpoint, in the resource locator and in every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step.\n\nGROUP_ID and CLUSTER_NAME in the endpoint paths are placeholders the deployment binds to concrete values before enabling; groups and projects are synonymous in Atlas.\n\nStored credential format: this HTTP registration defines one exact stored value — an externally minted OAuth 2.0 service-account access token stored as the complete 'Bearer <token>' Authorization header value (see the credential note). The Atlas Administration API also accepts legacy HTTP Digest API keys, whose public-key:private-key challenge flow cannot be represented as a single injected header value; Digest is deliberately outside this pack unless a separately declared, reviewed Digest-capable connector represents that behavior.\n\nDocumented exclusions — this pack does not register: project or organization deletion (DELETE /api/atlas/v2/groups/{groupId} and organization-level endpoints), backup restore jobs (a restore overwrites current cluster data) and snapshot export or download, database user update and deletion (PATCH/DELETE.../databaseUsers/{databaseName}/{username} — the path carries the authentication database as well as the username) and password changes, access list entry deletion (DELETE.../accessList/{entryValue} — removing an entry is a network-boundary change that can lock out legitimate clients and deserves its own review), programmatic API key management endpoints (creating or deleting Atlas API keys themselves), invoice and billing endpoints, federation and identity-provider configuration, private endpoint and network peering management, live migration, and anything on the data plane — the Atlas Administration API does not read or write data stored in clusters, so no database-content capability exists here to register.\n\nThe Atlas API explorer pages are large client-side documents; the routes registered here follow the documented v2 shapes (groups, clusters, databaseUsers, accessList) and were verified on 2026-09-21 against the retrieved Atlas Administration API v2 reference (see the review record).\n\nThe reviewed sources establish: the operation-specific roles (pause/resume requires Project Cluster Manager or higher; termination requires Project Owner or Organization Owner) and the pause effects (backups stopped, all data deleted from separately deployed Search Nodes and rebuilt on resume) come from the fetched pause-terminate page, and the OAuth service-account flow and the negotiated media version (Accept: application/vnd.atlas.<date>+json) come from the fetched v2 API reference page — how the HTTP connector pins that Accept header is a deployment binding decision, not something this registration encodes.",
  "credential": {
    "secret_ref_id": "secret-ref-mongodb-atlas-api-key",
    "custody": "customer_vault",
    "inject": "header",
    "inject_name": "Authorization",
    "note": "An OAuth 2.0 service-account access token for the customer's own Atlas organization or project, held in the client's own secret manager. This registration defines one exact stored value: the complete Authorization header value 'Bearer ' followed by the access token, minted by an external deployment process that exchanges the service-account client id and client secret at the Atlas token endpoint (POST /api/oauth/token); the injector places the stored value verbatim into the Authorization header.\n\nAtlas also accepts legacy HTTP Digest API keys, but a Digest public-key:private-key pair drives a challenge-response flow that cannot be represented as one injected header value, so Digest material must never be stored under this secret_ref_id — a deployment that needs Digest requires a separately declared, reviewed Digest-capable connector (see the pack notes). Service-account access tokens are valid for one hour, so the external custody job must refresh the stored value before expiry; an expired value fails closed.\n\nRevocation handling: rotating or revoking a service-account client secret stops new tokens being issued; the reviewed documentation does not state that secret revocation invalidates already-issued access tokens, but Atlas documents a per-token revocation endpoint (POST /api/oauth/revoke, called with the service account's client id and secret) — so the external process should revoke any outstanding token explicitly and otherwise treat issued tokens as live until their one-hour expiry.\n\nLeast privilege: grant the credential only the roles these capabilities need (read-only project roles for the reads, project cluster manager for cluster lifecycle) — to terminate a cluster Atlas itself requires Project Owner or Organization Owner, which is far more than the rest of this pack needs, so a deployment not ready for that role should remove the delete capability.\n\nIP access list: if the organization requires an Atlas Administration API IP access list, tokens can be created from any address but API calls must originate from a listed address — the deployment's egress must satisfy it.\n\nExecutor hygiene: the resolved material must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack."
  },
  "capabilities": [
    {
      "capability_id": "mongodb.atlas.projects.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "mongodb-atlas.invalid"
      ],
      "endpoint": "https://mongodb-atlas.invalid/api/atlas/v2/groups",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-mongodb-atlas-api-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "mongodb-atlas-project",
      "description": "List the Atlas projects (groups) the credential can see: names and ids, which reveal org structure. The registered path covers the collection read only — single-project reads and organization-level listings are not registered.\n\nThe host is a reserved placeholder: substitute the real Atlas Administration API host before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "mongodb.atlas.clusters.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "mongodb-atlas.invalid"
      ],
      "endpoint": "https://mongodb-atlas.invalid/api/atlas/v2/groups/GROUP_ID/clusters",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-mongodb-atlas-api-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "mongodb-atlas-project",
      "description": "List the clusters in one Atlas project: names, tiers, regions and states. The registered path covers the collection read only — single-cluster reads (GET.../clusters/{clusterName}) are not registered.\n\nGROUP_ID is a placeholder the deployment binds before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "mongodb.atlas.database_users.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "mongodb-atlas.invalid"
      ],
      "endpoint": "https://mongodb-atlas.invalid/api/atlas/v2/groups/GROUP_ID/databaseUsers",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-mongodb-atlas-api-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "mongodb-atlas-project",
      "description": "List the database users in one Atlas project: usernames, authentication databases and roles. Usernames commonly identify people or services, so the read registers at the pii class. Passwords are never returned by the API. The registered path covers the collection read only.\n\nGROUP_ID is a placeholder the deployment binds before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "mongodb.atlas.access_list.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "mongodb-atlas.invalid"
      ],
      "endpoint": "https://mongodb-atlas.invalid/api/atlas/v2/groups/GROUP_ID/accessList",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-mongodb-atlas-api-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "mongodb-atlas-project",
      "description": "List the project IP access list entries: the CIDR blocks and addresses permitted to reach the clusters. This is the network-boundary configuration, read only — modifying it is registered separately at R3.\n\nGROUP_ID is a placeholder the deployment binds before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "mongodb.atlas.cluster.create",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "mongodb-atlas.invalid"
      ],
      "endpoint": "https://mongodb-atlas.invalid/api/atlas/v2/groups/GROUP_ID/clusters",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-mongodb-atlas-api-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "create",
        "deploy"
      ],
      "resource_id": "mongodb-atlas-project",
      "description": "Create one cluster in the project.\n\nThe request body is an unrestricted cluster definition: provider, region, tier, replication and backup settings are all settable, so the registered capability carries the full create effect — the body also decides ongoing billed spend, and cost review belongs to the deployment's budget controls, not to this file.\n\nCreating a cluster provisions live, billable cloud infrastructure: the moment the call succeeds a real cluster exists and accrues cost until terminated, so the capability declares create and deploy at the minimum R3 tier — deploy is one of the designated actions requiring human approval — and an installer's intention to request only a small cluster is not a restriction the registration can enforce.",
      "requires_review": true
    },
    {
      "capability_id": "mongodb.atlas.cluster.pause",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "mongodb-atlas.invalid"
      ],
      "endpoint": "https://mongodb-atlas.invalid/api/atlas/v2/groups/GROUP_ID/clusters/CLUSTER_NAME",
      "method": "PATCH",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-mongodb-atlas-api-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "update",
        "delete",
        "deploy"
      ],
      "resource_id": "mongodb-atlas-project",
      "description": "Update a cluster's configuration, including pausing it. The body is unrestricted: callers can change tier, regions, and backup settings as well as paused. Those changes can provision live billable infrastructure; this is not a pause-only permission.\n\nPausing stops reads, writes, and backups. Existing snapshots remain only until expiry. Atlas deletes data from separately deployed Search Nodes and rebuilds indexes after resume. The capability therefore declares update, delete, and deploy at R3 to cover configuration changes, data destruction, and new capacity. Bind GROUP_ID and CLUSTER_NAME before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "mongodb.atlas.cluster.delete",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "mongodb-atlas.invalid"
      ],
      "endpoint": "https://mongodb-atlas.invalid/api/atlas/v2/groups/GROUP_ID/clusters/CLUSTER_NAME",
      "method": "DELETE",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-mongodb-atlas-api-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "delete"
      ],
      "resource_id": "mongodb-atlas-project",
      "description": "Terminate a cluster. Atlas documents that terminating a cluster also deletes its backup snapshots unless the deployment explicitly opted to keep them, and that deletion of clusters and their data is permanent — MongoDB provides no recovery of deleted data. Delete is one of the designated actions requiring human approval and registers at the minimum R3 tier.\n\nOn supported AAES-mediated execution paths, irreversible actions require approval by an authorized person; this does not prevent calls through bypass or observation-only paths. Atlas itself gates termination behind Project Owner or Organization Owner and offers Termination Protection, which must be disabled first.\n\nGROUP_ID and CLUSTER_NAME are placeholders the deployment binds before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "mongodb.atlas.database_user.create",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "mongodb-atlas.invalid"
      ],
      "endpoint": "https://mongodb-atlas.invalid/api/atlas/v2/groups/GROUP_ID/databaseUsers",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-mongodb-atlas-api-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "create",
        "share"
      ],
      "resource_id": "mongodb-atlas-project",
      "description": "Create one database user.\n\nThe request body carries the new user's password — secret material in the request, which the executor must keep out of logs exactly like the Atlas credential itself — and the roles the body assigns grant access to cluster data. Granting data access is access-sharing: share is one of the designated actions requiring human approval, so the capability registers create and share at the minimum R3 tier rather than as an ordinary create.\n\nThe body is unrestricted (any roles the caller's Atlas roles permit), which an installer's intention does not narrow.\n\nGROUP_ID is a placeholder the deployment binds before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "mongodb.atlas.access_list.update",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "mongodb-atlas.invalid"
      ],
      "endpoint": "https://mongodb-atlas.invalid/api/atlas/v2/groups/GROUP_ID/accessList",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-mongodb-atlas-api-key",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "create",
        "share"
      ],
      "resource_id": "mongodb-atlas-project",
      "description": "Add entries to the project IP access list, which decides which networks may reach every cluster in the project.\n\nThe request body is an unrestricted list of CIDR blocks or addresses: an entry of 0.0.0.0/0 shares the database endpoints with the entire internet, and any entry grants network-level access to whatever it names — access-sharing, which is why the capability registers create and share at the minimum R3 tier even though an added entry can later be removed. Removing entries (DELETE.../accessList/{entryValue}) is deliberately not registered by this pack; see the pack notes.\n\nGROUP_ID is a placeholder the deployment binds before enabling.",
      "requires_review": true
    }
  ],
  "resources": [
    {
      "resource_id": "mongodb-atlas-project",
      "kind": "api",
      "locator": "https://mongodb-atlas.invalid/api/atlas/v2/groups/GROUP_ID",
      "data_class": "pii",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    }
  ],
  "review": {
    "state": "library",
    "date": "2026-09-22",
    "sources": [
      "https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/ (retrieved 2026-09-21)",
      "https://www.mongodb.com/docs/atlas/configure-api-access/ (retrieved 2026-09-21)",
      "https://www.mongodb.com/docs/atlas/pause-terminate-cluster/ (retrieved 2026-09-21)",
      "https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listprojects (retrieved 2026-09-21)",
      "https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listclusters (retrieved 2026-09-21)",
      "https://www.mongodb.com/docs/atlas/api/api-authentication/ (retrieved 2026-09-21)",
      "https://www.mongodb.com/docs/atlas/api/service-accounts/revoke-oauth2-token/ (retrieved 2026-09-21)"
    ],
    "reviewer_id": "aaes-eng"
  }
}