# Contracts: Graph Contract Registry Updates (Provider Foundation v1)

**Branch**: `061-provider-foundation`  
**Date**: 2026-01-24

## Purpose

Provider foundation operations must not introduce ad-hoc Microsoft Graph endpoints. Any new Graph resources required by provider modules should be added to the central registry (`config/graph_contracts.php`) and consumed via `GraphClientInterface`.

## Required additions (v1)

### 1) Connection health check

**Operation**: Provider connection health check (“ping”)  
**Graph call**: `GET /organization` (basic org metadata)  
**Registry note**: Ensure the org endpoint is modeled/approved in the contract registry (either as a first-class type or as an explicitly allowed internal call within the Graph client).

---

### 2) Compliance snapshot (counts)

**Operation**: Compliance snapshot (device compliance state counts)  
**Graph calls** (one of the contract-approved patterns):

- Option A: List managed devices with a minimal select and compute counts client-side.
  - Resource: `deviceManagement/managedDevices`
  - Required fields: `id`, `complianceState`

- Option B: Use Graph count endpoints / filtered counts if supported reliably.
  - Resource: `deviceManagement/managedDevices/$count` (with filters)

**Registry note**: Add a contract entry for managed devices (and any count strategy used) with allowed selects/filters to prevent accidental over-fetching.

---

## Existing registry reuse

Provider inventory collection should prefer existing policy-type contracts already present in `config/graph_contracts.php` (e.g., Intune policy types and directory group listing), rather than introducing new “quick endpoints”.