| operation | One of validate, cli-test, contract-test, or onboard. | no | validate |
| project-name | Service name used by the selected Postman-CS action. | yes | — |
| onboarding-config-path | Repo-relative path to the Postman onboarding configuration. | no | .postman-template/onboarding.yml |
| spec-path | Repo-relative path to the authoritative OpenAPI document. | no | — |
| workspace-id | Existing customer workspace ID for onboard. Not used by sandbox tests. | no | — |
| test-workspace-name | Exact sandbox workspace name. Test operations are locked to Winter Trinity. | no | Winter Trinity |
| test-workspace-id | Optional expected Winter Trinity workspace ID for an additional identity check. | no | — |
| pr-number | Pull request number for contract-test when event discovery is unavailable. | no | — |
| postman-api-key | PMAK resolved from the customer secret manager. Never put this value in YAML. | no | — |
| postman-access-token | Optional Postman service access token resolved from the customer secret manager. | no | — |
| github-token | GitHub token used by the Postman-CS action when GitHub API access is required. | no | — |
| postman-team-id | Optional explicit Postman team identifier. | no | — |
| workspace-team-id | Optional numeric Postman sub-team identifier for org-mode workspace creation. | no | — |
| postman-region | Postman data residency region, us or eu. | no | us |
| postman-stack | Postman stack, prod or beta. | no | prod |
| config-write-mode | TDD configuration mutation policy. Defaults to no writes. | no | none |
| repo-write-mode | Onboarding repository mutation policy. Defaults to no writes. | no | none |
| credential-preflight | Credential identity check policy, warn or enforce. | no | enforce |
| enable-insights | Enable Postman Insights onboarding during the onboard operation. | no | false |
| cli-smoke-collection-id | Optional collection ID run by operation=cli-test inside Winter Trinity. | no | — |
| cli-contract-collection-id | Optional collection ID run by operation=cli-test inside Winter Trinity. | no | — |
| cli-environment-id | Optional environment ID applied to CLI smoke and contract runs. | no | — |
| cli-report-directory | Repo-relative directory for CLI JUnit reports. | no | .postman-cli-reports |
| cli-report-format | junit for Postman Collection v2 HTTP runs, or cli-only for collection formats that do not support the JUnit reporter (including v3 YAML). | no | junit |
| approve-onboarding-risk | Explicit human gate for onboard while the pinned upstream composite has transitive release-tag references. Must remain false for the initial proof. | no | false |