{
  "_comment": "Every call the provider notices kit makes: one read per row, with the tool that sends it, the least-privileged role or permission the provider's own documentation names for it, the page that says so, and whether the call has been checked against that page. Read on November 9, 2026. The live invoker refuses a call whose 'verified' is false unless the run passes -AllowUnverified, and refuses any call not listed here. Nothing here writes to a tenant, account, tenancy or project. 'fixture' is the file the call reads in fixture mode (Lab 1), under the provider's folder.",
  "readOn": "2026-11-09",
  "calls": [
    {
      "id": "azure-service-health-events",
      "provider": "azure",
      "tool": "az",
      "operation": "az graph query (Azure Resource Graph, ServiceHealthResources, type microsoft.resourcehealth/events)",
      "method": "read (Resource Graph query)",
      "permissions": ["Reader on each subscription in scope"],
      "elevated": "Service Health Security Reader (or a role with Microsoft.ResourceHealth/events/fetchEventDetails/action, .../listSecurityAdvisoryImpactedResources/action and .../events/action) to see the sensitive fields of security advisories; Reader and Monitoring Reader can't",
      "doc": "https://learn.microsoft.com/azure/service-health/resource-graph-samples",
      "permissionDoc": "https://learn.microsoft.com/azure/service-health/subscription-vs-tenant",
      "verified": true,
      "fixture": "service-health-events.json"
    },
    {
      "id": "azure-impacted-resources",
      "provider": "azure",
      "tool": "az",
      "operation": "az graph query (ServiceHealthResources, type microsoft.resourcehealth/events/impactedresources), Learn's query as published",
      "method": "read (Resource Graph query)",
      "permissions": ["Reader on each subscription in scope"],
      "elevated": "Service Health Security Reader for the impacted resources of a security advisory, which Learn always treats as sensitive",
      "doc": "https://learn.microsoft.com/azure/service-health/resource-graph-impacted-samples",
      "permissionDoc": "https://learn.microsoft.com/azure/service-health/impacted-resources-security",
      "verified": true,
      "fixture": "impacted-resources.json"
    },
    {
      "id": "m365-messages",
      "provider": "m365",
      "tool": "graph",
      "operation": "GET /v1.0/admin/serviceAnnouncement/messages (Message center)",
      "method": "GET",
      "permissions": ["ServiceMessage.Read.All"],
      "elevated": "Delegated: the signed-in user also needs an admin role; data privacy messages need Global Administrator or Message Center Privacy Reader",
      "doc": "https://learn.microsoft.com/graph/api/serviceannouncement-list-messages?view=graph-rest-1.0",
      "permissionDoc": "https://learn.microsoft.com/graph/api/resources/service-communications-api-overview",
      "verified": true,
      "fixture": "messages.json"
    },
    {
      "id": "m365-issues",
      "provider": "m365",
      "tool": "graph",
      "operation": "GET /v1.0/admin/serviceAnnouncement/issues (service health issues)",
      "method": "GET",
      "permissions": ["ServiceHealth.Read.All"],
      "elevated": "Delegated: the signed-in user also needs an admin role",
      "doc": "https://learn.microsoft.com/graph/api/serviceannouncement-list-issues?view=graph-rest-1.0",
      "permissionDoc": "https://learn.microsoft.com/graph/api/resources/service-communications-api-overview",
      "verified": true,
      "fixture": "issues.json"
    },
    {
      "id": "m365-health-overviews",
      "provider": "m365",
      "tool": "graph",
      "operation": "GET /v1.0/admin/serviceAnnouncement/healthOverviews (current status per service, for the digest)",
      "method": "GET",
      "permissions": ["ServiceHealth.Read.All"],
      "elevated": "Delegated: the signed-in user also needs an admin role",
      "doc": "https://learn.microsoft.com/graph/api/serviceannouncement-list-healthoverviews?view=graph-rest-1.0",
      "permissionDoc": "https://learn.microsoft.com/graph/api/resources/service-communications-api-overview",
      "verified": true,
      "fixture": "health-overviews.json"
    },
    {
      "id": "oci-announcements-list",
      "provider": "oci",
      "tool": "oci",
      "operation": "oci announce announcements list --compartment-id <tenancy OCID> --all (ListAnnouncements, GET /20180904/announcements)",
      "method": "GET",
      "permissions": ["Allow group <group> to inspect announcements in tenancy (list only)"],
      "elevated": "Allow group <group> to read announcements in tenancy, for the details call",
      "doc": "https://docs.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/announce/announcements/list.html",
      "permissionDoc": "https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/announcementspolicyreference.htm",
      "verified": true,
      "fixture": "announcements.json"
    },
    {
      "id": "oci-announcement-get",
      "provider": "oci",
      "tool": "oci",
      "operation": "oci announce announcements get --announcement-id <OCID> (GetAnnouncement: description, additionalInformation, affectedResources)",
      "method": "GET",
      "permissions": ["Allow group <group> to read announcements in tenancy"],
      "elevated": "",
      "doc": "https://docs.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/announce/announcements/get.html",
      "permissionDoc": "https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/announcementspolicyreference.htm",
      "verified": true,
      "fixture": "announcement-details.json"
    },
    {
      "id": "aws-describe-events",
      "provider": "aws",
      "tool": "aws",
      "operation": "aws health describe-events (AWS Health API DescribeEvents), open and upcoming events",
      "method": "read (AWS Health API)",
      "permissions": ["health:DescribeEvents"],
      "elevated": "The account needs a qualifying AWS Support plan (AWS's pages name the plans differently), or the API answers SubscriptionRequiredException. AWS publishes no read-only managed policy for Health: use a customer managed policy with the three actions",
      "doc": "https://docs.aws.amazon.com/cli/latest/reference/health/describe-events.html",
      "permissionDoc": "https://docs.aws.amazon.com/health/latest/ug/security_iam_id-based-policy-examples.html",
      "verified": true,
      "fixture": "describe-events.json"
    },
    {
      "id": "aws-describe-event-details",
      "provider": "aws",
      "tool": "aws",
      "operation": "aws health describe-event-details --event-arns <up to 10 ARNs> (the event description)",
      "method": "read (AWS Health API)",
      "permissions": ["health:DescribeEventDetails"],
      "elevated": "",
      "doc": "https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventDetails.html",
      "permissionDoc": "https://docs.aws.amazon.com/health/latest/ug/security_iam_id-based-policy-examples.html",
      "verified": true,
      "fixture": "describe-event-details.json"
    },
    {
      "id": "aws-describe-affected-entities",
      "provider": "aws",
      "tool": "aws",
      "operation": "aws health describe-affected-entities --filter eventArns=<up to 10 ARNs>",
      "method": "read (AWS Health API)",
      "permissions": ["health:DescribeAffectedEntities"],
      "elevated": "",
      "doc": "https://docs.aws.amazon.com/health/latest/APIReference/API_AffectedEntity.html",
      "permissionDoc": "https://docs.aws.amazon.com/health/latest/ug/security_iam_id-based-policy-examples.html",
      "verified": true,
      "fixture": "describe-affected-entities.json"
    },
    {
      "id": "google-events",
      "provider": "google",
      "tool": "gcloud",
      "operation": "gcloud service-health events list --project=<project> --location=global (GET v1/projects/*/locations/global/events)",
      "method": "GET",
      "permissions": ["roles/servicehealth.viewer (Personalized Service Health Viewer) on the project: servicehealth.events.list"],
      "elevated": "The Service Health API must be enabled on the project (gcloud services enable servicehealth.googleapis.com), which is a change the project owner makes once",
      "doc": "https://docs.cloud.google.com/sdk/gcloud/reference/service-health/events/list",
      "permissionDoc": "https://docs.cloud.google.com/iam/docs/roles-permissions/servicehealth",
      "verified": true,
      "fixture": "events.json"
    },
    {
      "id": "google-organization-events",
      "provider": "google",
      "tool": "gcloud",
      "operation": "gcloud service-health organization-events list --organization=<organization> --location=global (GET v1/organizations/*/locations/global/organizationEvents)",
      "method": "GET",
      "permissions": ["roles/servicehealth.viewer on the organization: servicehealth.organizationEvents.list"],
      "elevated": "",
      "doc": "https://docs.cloud.google.com/service-health/docs/reference/rest/v1/organizations.locations.organizationEvents/list",
      "permissionDoc": "https://docs.cloud.google.com/iam/docs/roles-permissions/servicehealth",
      "verified": false,
      "unverified": "The gcloud group organization-events is listed on the gcloud beta reference; the exact GA flags for it weren't read. The REST call is verified",
      "fixture": "organization-events.json"
    }
  ]
}
