{ "schema": "aaes/capability-pack/1", "provider": "outreach", "version": "1.0.0", "description": "Read Outreach prospects, mailings, tasks, and events; enroll prospects in a sequence. Enrollment starts automation immediately and can send outbound email from the selected mailbox.", "notes": "The endpoint host api.outreach.io is Outreach's real shared API host and stays real; there is no per-customer host to substitute. The API speaks JSON:API: write requests must carry Content-Type application/vnd.api+json, and reads page with the JSON:API pagination parameters. Reads are registered against collection endpoints that Outreach's own guide documentation shows explicitly; single-record reads (GET /api/v2/prospects/{id} and the other by-id paths) are not registered by this pack.\n\nOperation-specific evidence: the sequence-states create is shown in the guide's 'Add Prospects to Sequences' section (POST /api/v2/sequenceStates, automation begins, state set to active), the tasks read in 'Discover Open Tasks' (GET /api/v2/tasks with state and owner filters), and the events read in 'Download Event Activity' (GET /api/v2/events?sort=-updatedAt); the mailings collection appears in the guide as a documented related-resource link (GET /api/v2/mailings?filter[template][id]=1 in the templates section) and in the platform-statistics discussion, while the guide's dedicated mailings section is marked 'More information coming soon' — mailings.read therefore rests on that related-link evidence rather than a worked collection example, and a reviewer who renders the interactive API reference should confirm it before enabling.\n\nDocumented exclusions — this pack does not register: account reads and sequence reads, because those collection GETs are enumerated only in Outreach's interactive API reference, a JavaScript application whose endpoint pages could not be rendered for this review — per the pack standard, fewer capabilities are registered rather than padding the pack from third-party sources, and a reviewer who renders the reference can add them; prospect, account, sequence, sequence-step, ruleset and template creation or update; the sequence-state finish, pause and resume actions; one-off mailing scheduling (Outreach's guide marks that section's documentation as not yet published); compliance deletion requests (permanent CCPA/GDPR deletes of a prospect or individual, processed asynchronously); call logging; user invitation (which by default sends the invitee an email); and webhooks.\n\nApproval classification: sales engagement is send-first. Creating a sequence state enrolls a prospect in a sequence and Outreach documents that the sequence's automation begins immediately with the state set to active; sequence steps include auto_email, which sends the enrolled person outbound email from the referenced mailbox without further human action — a delivered email cannot be recalled — so the capability declares create and send, and send keeps the tier at the minimum R3 tier; send is one of the designated actions requiring human approval.\n\nThe events read returns the platform's event stream (for example prospect_updated), which records the activity of named users and references individual prospects, so it is classified as pii (personal data); tasks reference prospects and carry user notes, and mailings carry message bodies and recipient addresses, so those reads are pii as well. Credential review completed on 2026-09-21 for a user-granted OAuth access token held in the customer's vault and refreshed by an external process. The requirements and limits are below.\n\nIssuance authority and delegation: tokens are minted by Outreach's token endpoint through the authorization-code flow against an Outreach app the customer configures, and the token acts on the granting user's behalf; the customer's governance permissions still bound what the token can touch beyond the OAuth scopes.\n\nScope: scopes are period-separated strings of the form . and are not additive — prospects.write does not grant prospects.read — so the grant is exactly prospects.read, mailings.read, tasks.read and events.read for the reads, plus sequenceStates.write only if the enrollment capability is enabled; sequenceStates.all (which adds delete) is deliberately not requested.\n\nAudience: no audience mechanism is documented — the bearer value authorizes against api.outreach.io, and audience binding beyond that is not established. TTL: access tokens live for 2 hours (expires_in 7200) and refresh tokens for 14 days, and a user/application pair can hold at most 100 refresh tokens at a time.\n\nRefresh ownership: refresh and rotation ownership sit entirely with an external process; Outreach issues a new refresh token with each new access token and a replaced refresh token must not be persisted, so the process must always store the newest value; the executor injects the stored value verbatim and performs no token lifecycle itself.\n\nRevocation: tokens are revoked when the customer revokes the authorization grant, and an expired or revoked value fails closed; the reviewed documentation describes grant-level revocation and enumerates no token-revocation endpoint, so none is claimed. Executor access and replay/exposure: the executor reads only the vault reference; the token is a bearer credential replayable within its two-hour TTL, and refresh rotation plus the 14-day refresh-token lifetime bound a stolen refresh token's window.\n\nAlternate access paths: the Outreach UI and other applications retain access outside this pack, and revoking this grant closes only this path. The credential review is complete. Assign accountable owners before deployment.", "credential": { "secret_ref_id": "secret-ref-outreach-oauth", "custody": "customer_vault", "inject": "header", "inject_name": "Authorization", "note": "An Outreach OAuth 2.0 access token (authorization-code flow against an Outreach app configured by the customer), held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Bearer', one separating space, then the token.\n\nAccess tokens live for 2 hours (expires_in 7200) and refresh tokens for 14 days, and refresh tokens rotate: Outreach issues a new refresh token with each new access token, a replaced refresh token must not be persisted, and a user/application pair can hold at most 100 refresh tokens at a time.\n\nRefresh and rotation ownership sit entirely with an external process; the executor injects the stored value verbatim and performs no token lifecycle itself.\n\nScopes are period-separated strings of the form . and are not additive — prospects.write does not grant prospects.read — so request exactly the scopes the enabled capabilities need: prospects.read, mailings.read, tasks.read and events.read for the reads, and sequenceStates.write only if the enrollment capability is enabled — sequenceStates.all (which adds delete) is not the least-privilege recommendation where sequenceStates.write suffices and is not offered as an interchangeable alternative. OAuth scopes are the front gate only; the customer's governance permissions still bound what the token can touch.\n\nRevocation: tokens are revoked when the customer revokes the authorization grant, and an expired or revoked value fails closed.\n\nExecutor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack." }, "capabilities": [ { "capability_id": "outreach.prospects.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "api.outreach.io" ], "endpoint": "https://api.outreach.io/api/v2/prospects", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-outreach-oauth", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "outreach-prospects", "description": "List prospect records: names, email addresses, titles and engagement counts, which identify named people, so the read is classified as pii (personal data). The registered path covers the collection read only — single-prospect reads (GET /api/v2/prospects/{id}) are not registered by this pack. Requires the prospects.read scope.", "requires_review": true }, { "capability_id": "outreach.mailings.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "api.outreach.io" ], "endpoint": "https://api.outreach.io/api/v2/mailings", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-outreach-oauth", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "outreach-mailings", "description": "List mailing records: subjects, bodies, recipient addresses and delivery information for emails the platform sent or received — correspondence of identified people, so the read is classified as pii (personal data). The registered path covers the collection read only — single-mailing reads are not registered by this pack. Requires the mailings.read scope.", "requires_review": true }, { "capability_id": "outreach.tasks.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "api.outreach.io" ], "endpoint": "https://api.outreach.io/api/v2/tasks", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-outreach-oauth", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "outreach-tasks", "description": "List task records: action type (call, email, in person or action item), state, owner and the related prospect — work items tied to named users and prospects, so the read is classified as pii (personal data). The registered path covers the collection read only — single-task reads and task completion are not registered by this pack. Requires the tasks.read scope.", "requires_review": true }, { "capability_id": "outreach.events.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "api.outreach.io" ], "endpoint": "https://api.outreach.io/api/v2/events", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-outreach-oauth", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "outreach-events", "description": "Read the platform event stream (for example prospect_updated), which records the activity of named users and references individual prospects — activity records about identifiable people, so the read is classified as pii (personal data). Requires the events.read scope.", "requires_review": true }, { "capability_id": "outreach.sequence-states.create", "version": "1.0.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "api.outreach.io" ], "endpoint": "https://api.outreach.io/api/v2/sequenceStates", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-outreach-oauth", "inject": "header", "inject_name": "Authorization", "actions": [ "create", "send" ], "resource_id": "outreach-prospects", "description": "Create a sequence state: enroll a named prospect in a sequence from a named mailbox. Outreach documents that once the sequence state is created the sequence's automation begins immediately with the state set to active, and sequence steps include auto_email — so the enrolled person experiences the platform sending them the sequence's outbound emails from that mailbox without further human action, and a delivered email cannot be recalled.\n\nThe capability therefore declares create (the sequence-state resource itself) and send (the automated outbound email the sequence then performs), and send keeps the tier at the minimum R3 tier; send is one of the designated actions requiring human approval.\n\nOn supported AAES-mediated execution paths, irreversible actions require approval by an authorized person; this does not prevent calls through bypass or observation-only paths. Requires the sequenceStates.write scope; sequenceStates.all (which adds delete) is not the least-privilege recommendation where sequenceStates.write suffices and is not offered as an interchangeable alternative.", "requires_review": true } ], "resources": [ { "resource_id": "outreach-prospects", "kind": "api", "locator": "https://api.outreach.io/api/v2/prospects", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "outreach-mailings", "kind": "api", "locator": "https://api.outreach.io/api/v2/mailings", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "outreach-tasks", "kind": "api", "locator": "https://api.outreach.io/api/v2/tasks", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "outreach-events", "kind": "api", "locator": "https://api.outreach.io/api/v2/events", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" } ], "review": { "state": "library", "date": "2026-09-22", "sources": [ "https://developers.outreach.io/api/getting-started (retrieved 2026-09-21)", "https://developers.outreach.io/api/oauth (retrieved 2026-09-21)", "https://developers.outreach.io/api/common-patterns (retrieved 2026-09-21)", "https://developers.outreach.io/api/common-patterns#add-prospects-to-sequences (retrieved 2026-09-21)", "https://developers.outreach.io/api/common-patterns#discover-open-tasks (retrieved 2026-09-21)", "https://developers.outreach.io/api/common-patterns#download-event-activity (retrieved 2026-09-21)" ], "reviewer_id": "aaes-eng" } }