| project-name | Service name or Jira/Xray project key to match against the final discovered-service segment | yes | — |
| workspace-id | Postman workspace ID to link the discovered service to | yes | — |
| environment-id | Postman environment UID for the onboarding association | yes | — |
| system-environment-id | Postman system environment UUID for service-level Insights acknowledgment | no | — |
| cluster-name | Insights cluster name. When set, matches {cluster-name}/{project-name} exactly in discovered services | no | — |
| repo-url | Repository URL for Git onboarding. Auto-detected from CI context when omitted. | no | — |
| postman-access-token | Required human-user session access token (x-access-token) for Bifrost and Akita linking calls. Service-account tokens are rejected and this action never mints or refreshes a token from a PMAK. | no | — |
| postman-team-id | Explicit Postman team ID for org-mode integration request headers. When omitted, x-entity-team-id is not sent. | no | — |
| github-token | Optional GitHub token passed as git_api_key when repository auth is required by onboarding/git | no | — |
| postman-api-key | Human-user Postman API key (PMAK-*) for observability application binding. It must resolve to the same human user as postman-access-token; service-account PMAKs are rejected. | no | — |
| create-api-key | Explicit opt-in to create a durable Bifrost API key when postman-api-key is omitted or invalid. Default false — never creates timestamp-named orphan keys on ordinary runs. Supported values: true, false. | no | false |
| credential-preflight | Credential identity preflight policy. Both modes require a human-user access token with consumerType=user; enforce additionally fails on parent-org mismatch. | no | enforce |
| service-not-found-policy | Behavior when the discovered service is absent after polling. fail (default) aborts full linking; warn returns status=not-found without writes. Supported values: fail, warn. | no | fail |
| poll-timeout-seconds | Maximum seconds to wait for the service to appear in the discovered list | no | 120 |
| poll-interval-seconds | Seconds between discovery polling attempts | no | 10 |
| postman-region | Postman data residency region for public API calls. One of: us or eu. | no | us |
| postman-stack | Postman stack profile. Defaults to the public production stack. Marketplace workflows should leave this as prod. | no | prod |
| branch-strategy | Branch-aware sync strategy. legacy (default) keeps branch-blind behavior; publish-gate restricts canonical writes to the canonical branch and skips on other branches; preview additionally maintains suffixed per-branch preview asset sets. | no | legacy |
| canonical-branch | Explicit canonical branch (the sole writer of canonical assets). Defaults to the provider-resolved default branch. | no | — |
| channels | Comma-separated channel map for long-lived promotion branches. | no | — |