API capability pack for bounded OneSignal REST API v1 operations against https://onesignal.com/api/v1 only. Enroll a OneSignal app API-key connection named onesignal that injects the Authorization header for the app_key security scheme; no credential is embedded in this manifest. The pack reads notifications, outcomes, users, user identity aliases, legacy player/device records, and subscription context for customer messaging operations. Writes are approval-gated and limited to creating or canceling one notification, creating one segment, creating or updating one user, updating one user identity object, and creating or updating one subscription. The pack intentionally excludes organization/user-key app administration, app create/update, API-key management, Live Activities, CSV export jobs, player/device deletion, segment deletion, user deletion, identity deletion, subscription owner transfer, arbitrary notification history export emails, webhooks, and arbitrary OneSignal API passthrough.