{
  "schema": "aaes/capability-pack/1",
  "provider": "ramp",
  "version": "1.0.0",
  "description": "Ramp: read transactions and users, create bills that start a payment workflow, and issue physical cards with provider-set spending limits.",
  "notes": "Use a Ramp API client whose OAuth scopes cover only what these capabilities need; the pack does not create one. POST /bills creates an approved bill with the payment nested in the same request — Ramp documents that bills created via the API skip the draft phase and are auto-approved, and that the payment is then processed on the bill's payment method and timing — so the call initiates a payment workflow whose documented end state is a processed payment, and it carries the pay action at the minimum R3 tier; pay is one of the designated actions requiring human approval; the registered cost ceiling and a policy budget are the second control.\n\nCard issuance is registered as create at R2, the create action's minimum tier — a lower bound, not a risk assessment: the card is spending power and the reviewer should confirm the spend limits the integration is allowed to request. The Ramp developer API is narrower than the Ramp dashboard, and this pack registers only what the API actually exposes: as of the OpenAPI export retrieved 2026-09-21 there is no reimbursement-creation endpoint (reimbursements are read-only over the API, with only mileage and receipt-upload POSTs) and no general card-creation endpoint (virtual cards are issued through funds; the card-vault POST requires separate Vault API access), so the pack registers neither — a documented, dated exclusion, not an approximated capability.\n\nThe pack says nothing about approvals, accounting sync or spend-program management, which the public API does not expose the same way. AAES has not been certified by Ramp; the endpoints here are configuration to review and test; the vendor has not endorsed it.",
  "credential": {
    "secret_ref_id": "secret-ref-ramp-api-token",
    "custody": "customer_vault",
    "inject": "header",
    "inject_name": "Authorization",
    "note": "An OAuth2 access token for the Ramp developer API, minted from the client's own Ramp API client and held in the client's own secret manager. The stored material must be the complete Authorization header value (scheme included). Access tokens expire: either store the client credentials and let the deployment mint tokens, or review the refresh path before enabling. The OAuth scopes are chosen at Ramp, and the minimum that makes these capabilities work is the right set."
  },
  "capabilities": [
    {
      "capability_id": "ramp.transactions.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "financial",
      "egress_allowlist": [
        "api.ramp.com"
      ],
      "endpoint": "https://api.ramp.com/developer/v1/transactions",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-ramp-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "ramp-account",
      "description": "Read card and spend transactions for the account.",
      "requires_review": true
    },
    {
      "capability_id": "ramp.users.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "api.ramp.com"
      ],
      "endpoint": "https://api.ramp.com/developer/v1/users",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-ramp-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "ramp-account",
      "description": "Read the account's users: names, emails and roles, which are personal data.",
      "requires_review": true
    },
    {
      "capability_id": "ramp.bills.create",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "financial",
      "egress_allowlist": [
        "api.ramp.com"
      ],
      "endpoint": "https://api.ramp.com/developer/v1/bills",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-ramp-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "pay"
      ],
      "resource_id": "ramp-account",
      "cost_ceiling_usd": 500,
      "description": "Create a bill with its nested payment. Ramp documents that bills created via the API skip the draft phase and are auto-approved, entering at Approved, and that the payment nested in the bill is then processed on the bill's payment method and timing — the call initiates a payment workflow whose documented end state is a processed payment, not money moved at request time, and the action is pay at the minimum R3 tier; pay is one of the designated actions requiring human approval.\n\nThe registered cost ceiling is a budget control on the declared amount: the gateway refuses a declared amount above it and commits the ceiling against the work budget; it does not bound the amount the provider request encodes.",
      "requires_review": true
    },
    {
      "capability_id": "ramp.cards.physical.create",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "financial",
      "egress_allowlist": [
        "api.ramp.com"
      ],
      "endpoint": "https://api.ramp.com/developer/v1/cards/physical",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-ramp-api-token",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "create"
      ],
      "resource_id": "ramp-account",
      "description": "Issue a physical card.\n\nIssuance creates spending power rather than moving money, and a card can be suspended or terminated, so the action is create at R2, the minimum tier; it does not establish that issuance is reversible. Review the spend limits the integration may request: the limit is set at the provider, not in this pack. Virtual-card issuance goes through the funds API, which this pack deliberately does not register.",
      "requires_review": true
    }
  ],
  "resources": [
    {
      "resource_id": "ramp-account",
      "kind": "api",
      "locator": "https://api.ramp.com/developer/v1",
      "data_class": "financial",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    }
  ],
  "review": {
    "state": "library",
    "date": "2026-09-23",
    "sources": [
      "https://docs.ramp.com/openapi/developer-api.json (retrieved 2026-09-21)",
      "https://docs.ramp.com/developer-api/v1/authorization (retrieved 2026-09-21)",
      "https://docs.ramp.com/developer-api/v1/bill-pay (retrieved 2026-09-21)",
      "https://support.ramp.com/accessing-the-developer-api (retrieved 2026-09-20)",
      "https://docs.ramp.com/llms-guides/authorization.txt (retrieved 2026-09-23)",
      "https://docs.ramp.com/llms-guides/bill-pay.txt (retrieved 2026-09-23)",
      "https://docs.ramp.com/llms-guides/bill-payments.txt (retrieved 2026-09-23)"
    ],
    "reviewer_id": "aaes-eng"
  }
}