API capability pack for bounded Netlify REST API operations against https://api.netlify.com/api/v1 by default. Enroll a netlify OAuth or personal-access-token bearer connection; no credential is embedded in the manifest. The pack reads the current user, accounts, account audit events, sites, TLS certificate status, deploys, builds, deployed branches, function bundles, forms, submissions, files, assets, snippets, site metadata, DNS zones and records, split tests, public add-on service metadata, database migration metadata, and database snapshots. Approval-gated writes are limited to one site/deploy/build/cache/env/split-test action at a time: enable or disable a site, cancel/restore/rollback/lock/unlock a deploy, trigger a non-upload build, purge cache for one site or tag set, update or remove one environment variable/value, and create/update/publish/unpublish one branch split test. The pack intentionally excludes deploy creation and file/function upload, build-hook reads or writes, deploy keys, OAuth tickets, account/member/billing mutation, site creation/deletion/update, DNS mutation, form/submission deletes, snippet injection writes, asset uploads/deletes, service instance mutation, AI gateway token reads, database connection-string reads, database create/delete/reset/restore/migration-run operations, agent-runner endpoints, plugin mutation, webhooks, and arbitrary API passthrough.