add_block_to_page | pages:edit | Add a block to a page (auto-generates the block id). Pass layoutRegion to add a layout block; omit it for a content block in the page body. Only call after the user confirms. If the result includes blockWarnings, the saved content violates the workspace block manifest (unknown field, wrong value shape, or a stored block whose type is no longer registered) - correct the content and save again, unless the warning is about a stored block whose type is no longer registered: that one is a manifest problem, so restore or sync the type, or find the block with list_block_usage and migrate or remove it. A block whose type the workspace block manifest does not register is refused unless the page already stores that block - pick registered types from list_block_types. |
bulk_delete_products | models:delete | Bulk-delete selected product records permanently. Only call after the user explicitly confirms. A product an open order or a page block still references is skipped rather than deleted; report every entry of `skipped` back to the user, with its reason. |
bulk_update_products | models:edit | Bulk-update selected product records with a single patch (status, set/adjust stock, set/adjust price). Stock is units; price is minor units. Only call after the user confirms. |
cancel_order | orders:manage | Cancel an order. Only call after the user confirms. |
clear_cart_config | site:config:edit | Remove the workspace's commerce settings entirely, putting the cart back to never-configured. Only call after the user explicitly confirms. A workspace with orders or carts is refused: report that back to the user and retry with force: true only once they confirm. To change individual settings rather than remove them, use update_cart_config. |
create_discount | discounts:manage | Create a discount code. `type` is 'percentage' (value 0-100), 'fixed' (value in minor currency units, requires currency e.g. 'USD'), or 'free_shipping' (value 0). Optional limits: minSubtotal, maxUses, startsAt, endsAt. Only call AFTER the user explicitly agreed to the code you described. |
create_form | forms:create | Create a new form with a name and slug. Optional: field definitions, per-field showWhen/requiredWhen conditions, and settings (action type, notifications). Fields can also be added later in the Forms editor. Only call AFTER the user explicitly agreed. |
create_manual_order | orders:manage | Create a manual (admin-entered) order. Each item references a product recordId or is an ad-hoc line with name+price (minor units). Only call after the user confirms. |
create_media_folder | media:upload | Create a media folder for organizing assets. Returns the folder, whose id can be passed to upload_media (folderId) or move_media. Only call after the user agreed to the folder you described. |
create_model | models:create | Create a data model in the workspace. Field types include select/multiselect (provide `options`), relation (link to another model via `relationTo` = the target model's slug + `relationType`), and object/list (nested `fields`/`itemFields`). Optional model-level config: slug, description, icon, color, displayField, defaultSort, statusField, `product` (commerce capability: enabled, priceField, skuField, inventoryField, variantAxes), `auth` (accounts: enabled, identityField, companyField/companyRoleField for a B2B company link), `uniqueFields` (field keys whose value must be unique - lets import_records update by that key) and `deliveryAccess` - a model is "none" (admin only) by default, so pass "public" when the user's app must read it through the delivery API. Only call AFTER the user has explicitly agreed to a structure you proposed (e.g. replied yes / clicked 'Yes, create'). Never create without that explicit go-ahead. |
create_page | pages:create | Create a new draft page with a name and slug (content/blocks are added later in the editor). Optional: parentId, pageType, multilingual displayName/seoTitle/seoDescription, customFields. Only call AFTER the user explicitly agreed. |
create_page_type | page:types:manage | Create a page type (template) with a custom-field schema. Pages of this type carry these custom fields. Only call after the user confirms. |
create_record | models:edit | Add a record (entry) to a data model. Pass the model id or slug and a `data` object whose keys are the model's field keys (use get_model first if unsure). Only call AFTER you described the record and the user explicitly agreed; never create without that go-ahead. |
create_webhook | webhooks:manage | Create a webhook endpoint subscribed to one or more events. The URL must be a public https endpoint. Returns the endpoint AND its signing secret (shown only once). Only call after the user confirms. |
delete_form | forms:delete | Permanently delete a form and all its submissions. Only call after the user explicitly confirms. |
delete_form_submission | forms:submissions:manage | Permanently delete a form submission. Only call after the user explicitly confirms. |
delete_media_folder | media:upload | Delete a media folder. By default only empty folders are removed; pass deleteContents to also delete the assets inside, and force to override the refusal that protects assets still in use. Only call after the user explicitly confirmed the deletion. |
delete_model | models:delete | Delete a data model. WARNING: this cascades - ALL records of the model are permanently deleted. Only call after the user explicitly confirms. |
delete_page | pages:delete | Permanently delete a page and all its descendants. Cannot delete the homepage. Only call after the user explicitly confirms. |
delete_page_type | page:types:manage | Delete a page type. Refused for system types and for a type any page still uses - move or delete those pages first. Only call after the user explicitly confirms. |
delete_record | models:delete | Permanently delete one record (entry) by its id. Only call after the user explicitly confirms. A record still used by page blocks is refused: report the listed pages back to the user and retry with force: true only once they confirm the reference may go stale. |
delete_webhook | webhooks:manage | Delete a webhook endpoint permanently. Only call after the user explicitly confirms. |
edit_order | orders:manage | Replace an order's line items (full replace of the items array). Recomputes totals. Only call after the user confirms. |
get_customer | customers:view | Get one customer by id: the account summary (identity, status, verification, lock, last login, company and role, and orderStats: non-canceled order count, last order date and net spend in minor units per currency, null without orders:view) plus the profile record's data. Read-only. |
get_discount | discounts:view | Get one discount's full details (type, value, usage limits, validity window) by id or code. |
get_form | forms:view | Get one form's full details (fields, settings, submission count) by id or slug. |
get_form_submission | forms:submissions:view | Get one form submission's full details by its id. |
get_model | models:view | Get the full details of one data model by id or slug: complete field definitions (type, options, relations, validation) the product capability config (enabled, field roles incl. the resolved `roles`, variantAxes) and the accounts config (`auth`: identityField, companyField/companyRoleField). Use before update_model and when the user asks about a model's structure. |
get_order | orders:view | Get one order's full details by its id: items, the full money column (subtotal, discount, shipping, tax, total - all minor units), the frozen discount code, PO number, shipping address and payment/fulfillment status. |
get_order_pipeline | orders:view | Get the workspace order pipeline (the configurable stages orders move through). |
get_page | pages:view | Get one page's full details (blocks, layout, page type, custom fields, and the SEO title/description/display name per language) by id or slug. Use when the user asks about a specific page's content, structure or SEO. |
get_page_type | page:types:view | Get one page type with its full custom-field schema - the field keys, types and options that pages of this type carry in customFields, and for relation fields their relationTo / relationType. Use before writing customFields on a page, because list_page_types does not return the fields. |
get_record | models:view | Get one record (entry) of a data model by its id, including all its field values and status. |
get_site_config | none | Get the workspace's site configuration: languages, site name, enabled features, and the cart/commerce settings (currency, tax rates, shipping methods). |
get_workspace_info | none | Get the current workspace's info: name, slug, plan and limits (max pages, users, storage, AI tokens). |
import_records | models:edit | Bulk-import records into a data model (up to 1000 rows). Without upsertKey each row CREATES a record; with upsertKey (a unique field or the product SKU field) a row matching an existing record UPDATES it instead, so a repeated sync does not duplicate. A translatable field takes a language map ({ title: { en: '...', no: '...' } }); a language the workspace has not enabled is rejected. Returns importedCount (created), updatedCount, per-row errors, and per-row record ids with CREATED / UPDATED / UNCHANGED. |
list_block_types | none | List the block types available on the workspace's site, each with its content field schema and default values. Use a block type's `schema` to shape `content` for add_block_to_page / update_block_content / patch_block_content - content is language-keyed ({ en: { fieldKey: value } }), and a relation field stores record id(s) per its relationTo/relationType. A non-empty `layoutRegions` marks a layout block (header/footer) managed via update_page_layout, not page body blocks. |
list_block_usage | pages:view | Show where each block type is stored across the workspace: draft and published page blocks, layout regions (draft and published) and developer drafts, with per-surface counts and the pages that hold it. `registered` says whether the active block manifest still declares the type; `orphanTypes` lists types stored but no longer registered (the site renders nothing for them), `unusedTypes` lists registered types no page uses. Use it before renaming or removing a block type in code, then migrate or remove the instances it lists with update_block_content / remove_block_from_page. |
list_carts | carts:view | List shopping carts (admin view) with optional status filter and pagination. totalValue is in minor units. |
list_customers | customers:view | List the customers - accounts that sign in to the user's site (records of an accounts model), with status, verification, last login, their company and orderStats (non-canceled order count, last order date, and net spend = paid minus refunded, in minor units, one entry per currency; null when the caller may not view orders). Not the team: those are list_team. Read-only; filter by model, status, company or an identity search; paginated, newest first. |
list_discounts | discounts:view | List discount codes in the workspace. Filter by enabled, type, or a code search; paginated. |
list_form_submissions | forms:submissions:view | List form submissions, optionally filtered by form and status; paginated. Returns submission rows with their data and status. |
list_forms | forms:view | List the forms in the workspace. Filter by status; paginated. |
list_media | media:view | List media files (images and files) in the workspace; paginated. |
list_media_folders | media:view | List media folders in the workspace (optionally under a parent folder). Use this to discover a folderId before uploading or moving assets. |
list_models | models:view | List the data models (content types) defined in the current workspace. Use to answer 'do we have models / a Product model?' or to see what data structures already exist. |
list_orders | orders:view | List orders in the workspace. Filter by payment/fulfillment status, customer, company (B2B), pipeline stage, a search string (customer email or company name), or a date range; paginated. Each order carries customerId, companyId and companyName when it was placed for a customer or a company. |
list_page_types | page:types:view | List the workspace's page types (templates) with their id, name, slug and url prefix. |
list_pages | pages:view | List the workspace's pages (id, name, slug, published), optionally filtered by a search string. |
list_products | models:view | List a product model's catalog with stock and variant info (onHand/reserved/available per record and variant). |
list_records | models:view | List the records (entries) of a data model, by the model's id or slug. Supports filtering (per key: scalar equality, $in, $gte/$lte, $regex), sort, and pagination. Each record includes its full data, so you can find a record by a field value (e.g. sku) without extra lookups. |
list_roles | roles:view | List the roles defined in this workspace and the permissions each one grants. Read-only. Useful for understanding who can do what. |
list_team | users:view | List the team - the people who manage this workspace - with their role and status (active, suspended, or a pending invitation). Not shoppers: those are records of the customer model. Read-only; filter by status or a search string; paginated. |
list_webhook_deliveries | webhooks:view | List recent webhook delivery attempts (status: pending/success/failed) for debugging. |
list_webhook_event_types | webhooks:view | List the event types a webhook can subscribe to (the authoritative allowlist). |
list_webhooks | webhooks:view | List the workspace's webhook endpoints (signing secrets are never returned here). |
mark_order_paid | orders:manage | Record a full payment for an order (manual reconciliation - does NOT verify with a payment provider). amount is in minor units. Only call after the user confirms. |
move_media | media:upload | Move one or more media assets into a folder (or to the root with folderId: null). Use list_media_folders to find the destination folderId. |
patch_block_content | pages:edit | Apply surgical HTML edits (insert_before/insert_after/replace_section) to a block's localized content string without re-sending the full content. Each op's marker must match exactly once. Only call after the user confirms. If the result includes blockWarnings, the saved content violates the workspace block manifest (unknown field, wrong value shape, or a stored block whose type is no longer registered) - correct the content and save again, unless the warning is about a stored block whose type is no longer registered: that one is a manifest problem, so restore or sync the type, or find the block with list_block_usage and migrate or remove it. A block whose type the workspace block manifest does not register is refused unless the page already stores that block - pick registered types from list_block_types. |
promote_dev_draft | pages:edit | Promote YOUR per-user dev draft overlay onto the page's shared draft (replaces the shared draft blocks; the overlay belongs to the token's user). Do this after the block code for the composed types is deployed to the site. Fails when you have no dev draft for the page. If the result includes blockWarnings, the promoted content violates the workspace block manifest - correct the content and save again. Promoting a block whose type the workspace block manifest does not register is refused - run cmssy sync-manifest from the deployed code first. Only call after the user confirms. |
publish_page | pages:publish | Publish a page (or re-publish with the latest draft changes). Publishes both content and layout. Only call after the user confirms. |
record_order_invoice | orders:manage | Attach an invoice (number, optional URL and provider) to an order. |
record_order_payment | orders:manage | Record a (possibly partial) payment against an order's outstanding balance. amount is in minor units and capped at the balance due. Only call after the user confirms. |
redeliver_webhook_delivery | webhooks:manage | Send a finished webhook delivery again. The stored payload goes out as a NEW delivery with its own id and its own retry ladder; the original row is left untouched and the new one records replayOf. A delivery that is still pending is refused. Only call after the user confirms. |
refund_order | orders:manage | Refund an order. Omit amount for a full refund; pass amount (minor units) for a partial refund. Only call after the user confirms. |
remove_block_from_page | pages:edit | Remove a specific block from a page by its instance id. Works for content and layout blocks. Only call after the user confirms. |
resend_customer_verification | customers:manage | Issue a fresh email verification link for a customer whose status is pending and email it; the previous link stops working and the new one lasts 24 hours. Refused for a customer who is already verified or is suspended, when the workspace has no public site URL, and after five account emails to the same customer in an hour. `emailSent: false` means the link was issued but the mailer did not take the email. Only call after the user confirms. |
revert_to_published | pages:edit | Discard all draft changes and revert a page to its last published version. Only call after the user confirms. |
rotate_webhook_secret | webhooks:manage | Rotate a webhook endpoint's signing secret. Returns the endpoint and the NEW secret (shown only once). Only call after the user confirms. |
send_customer_password_reset | customers:manage | Email a customer a password reset link, the same one the site's forgot-password flow sends; it works for one hour. For an active customer who cannot sign in. Refused for a suspended customer, for one who has not verified yet (use resend_customer_verification), for a customer whose account model has no password sign-in, when the workspace has no public site URL to link to, and after five account emails to the same customer in an hour. `emailSent: false` means the link was issued but the mailer did not take the email. Only call after the user confirms. |
set_discount_enabled | discounts:manage | Enable or disable a discount code. |
set_order_pipeline_stage | orders:manage | Move an order to a pipeline stage (use get_order_pipeline for valid stage ids). |
set_product_tiers | models:edit | Set the record-level volume price breaks on a product (B2B quantity discounts). They price the product and every variant that defines no breaks of its own; a variant's own breaks are part of its definition, so set those with the variants payload. A line's unit price steps down to the highest break its quantity reaches, and the cart and the order both charge that price. Prices are minor units. Passing an empty array removes the breaks. |
suspend_customer | customers:manage | Suspend a customer: blocks sign-in and ends every live session. Orders and carts stay. Refused for an account that has not verified yet or is already suspended. Only call after the user confirms. |
take_over_page_lock | pages:publish | Take over the edit lock on a page another editor is holding open, so the next write (publish_page, update_page_blocks, update_page_layout, ...) is not refused with PAGE_LOCKED. The previous holder is bounced to read-only and may lose unsaved work, so only call after the user confirms. Needs pages:edit or pages:publish on the page. |
transition_order_fulfillment | orders:manage | Move an order to a new fulfillment status. Optionally attach tracking when marking fulfilled. Only call after the user confirms. |
unlock_customer | customers:manage | Unlock a customer who was locked out after too many failed sign-ins: clears the failed-attempt counter, `lockedUntil` and the sign-in throttle for that identity, so the next sign-in with the right password succeeds. Does not change the password and does not reinstate a suspended customer (that is unsuspend_customer, which also clears the lock). Only call after the user confirms. |
unpublish_page | pages:publish | Unpublish a published page (toggles its published state off). Only call after the user confirms. |
unsuspend_customer | customers:manage | Let a suspended customer sign in again and clear any lockout. Refused for a customer who is not suspended. Only call after the user confirms. |
update_block_content | pages:edit | Update a specific block's content on a page. Defaults to merging with existing content; pass mode: 'replace' to overwrite the block's whole content. Works for content and layout blocks. Only call after the user confirms. If the result includes blockWarnings, the saved content violates the workspace block manifest (unknown field, wrong value shape, or a stored block whose type is no longer registered) - correct the content and save again, unless the warning is about a stored block whose type is no longer registered: that one is a manifest problem, so restore or sync the type, or find the block with list_block_usage and migrate or remove it. A block whose type the workspace block manifest does not register is refused on the shared draft unless the page already stores that block - compose types that are not deployed yet in target: 'devDraft' and promote once the code ships; pick registered types from list_block_types. |
update_cart_config | site:config:edit | Configure the workspace's commerce settings: currency, product source models, whether prices include tax, tax rates, shipping methods, stock thresholds, cart limits, session lifetimes and the B2B toggles - everything the admin cart settings page can set. Only provided fields change; arrays replace the whole list. |
update_discount | discounts:manage | Update a discount (partial). code/type/currency become immutable once the discount has been used. Only call after the user confirms. |
update_form | forms:edit | Update an existing form's name, slug, status, fields or settings. Name the settings keys you are changing - the rest keep their stored values. 'fields' is the opposite: it replaces the whole array, so send every field you want the form to keep. Only call after the user describes the change and confirms. |
update_form_submission_status | forms:submissions:manage | Update a form submission's status (pending, processed, spam, archived). |
update_media_folder | media:upload | Rename a media folder and/or move it under a different parent folder. Only call after the user agreed to the change. |
update_model | models:edit | Update a data model by id or slug: name, slug, description, icon, color, displayField, defaultSort, statusField, fields, product capability config, uniqueFields (replaces the whole list; refused while records already share a value), or deliveryAccess ("public" lets the user's app read the model through the delivery API; "none" is admin only). `fields` is a PATCH - listed fields are added or replaced by key, unlisted fields stay untouched; use `removeFields` to delete fields. `product` is also a PATCH of the commerce capability config (enabled, priceField, skuField, inventoryField, variantAxes) - omitted keys keep their stored values. `auth` is a PATCH of the accounts config (enabled, identityField, companyField + companyRoleField for B2B companies over customers, verification, lockout) - omitted keys keep their stored values, null clears a company key. Only call AFTER the user explicitly agreed to the change. |
update_order_details | orders:manage | Update order metadata: customer email, internal notes, shipment tracking, PO number and delivery address. Only provided fields change. |
update_page_blocks | pages:edit | Set the full content blocks array on a page (replaces all existing content blocks). Blocks with matching ids keep their existing content when not provided. Only call after the user confirms. If the result includes blockWarnings, the saved content violates the workspace block manifest (unknown field, wrong value shape, or a stored block whose type is no longer registered) - correct the content and save again, unless the warning is about a stored block whose type is no longer registered: that one is a manifest problem, so restore or sync the type, or find the block with list_block_usage and migrate or remove it. A block whose type the workspace block manifest does not register is refused on the shared draft unless the page already stores that block - compose types that are not deployed yet in target: 'devDraft' and promote once the code ships; pick registered types from list_block_types. |
update_page_layout | pages:edit | Update page-level layout: inheritance, overrides, or replace all layout blocks. Only call after the user confirms. If the result includes blockWarnings, the saved content violates the workspace block manifest (unknown field, wrong value shape, or a stored block whose type is no longer registered) - correct the content and save again, unless the warning is about a stored block whose type is no longer registered: that one is a manifest problem, so restore or sync the type, or find the block with list_block_usage and migrate or remove it. A block whose type the workspace block manifest does not register is refused unless the page already stores that block - pick registered types from list_block_types. |
update_page_settings | pages:edit | Update page metadata: name, slug, parent and position in the tree, display name, SEO fields and custom fields. Only the languages and fields you pass change - the ones you omit keep their current values. Only call after the user confirms. |
update_page_type | page:types:manage | Update a page type: name, slug, icon, url prefix, allowChildren, or its custom-field schema. Fields you omit keep their current value, EXCEPT `fields`, which replaces the whole schema. Only call after the user confirms. |
update_record | models:edit | Update an existing record by id (from list_records). Pass `data` to merge field values (fields you don't pass are unchanged), and/or `status` to transition the record's lifecycle state. At least one of data/status is required. Only call AFTER you described the change and the user explicitly agreed. |
update_region_settings | pages:edit | Set the settings of one layout region on a page, e.g. a sidebar's width or a header's variant. Reads the page's current region settings, replaces only the named region and writes the whole list back (page.updateLayout with layoutRegionSettings, one version-guarded write); entries for regions or keys the manifest no longer declares are pruned on the way. Values are validated against the workspace layout manifest's region settings schema: an unknown region, an unknown key, or non-empty values on a region that declares no settings (such a region accepts {} only) is rejected with the backend's BAD_USER_INPUT message. Child pages inherit the region's settings unless they set their own (see get_page.resolvedRegions). |
update_webhook | webhooks:manage | Update a webhook endpoint (partial). Pass enabled to enable/disable. Pass description=null to clear it. The signing secret is not returned. |
upload_media | media:upload | Upload a file to the workspace media library from a local path or a remote URL (max 50MB; images, video, audio, PDF and common office documents). Returns the stored asset whose `url` can be used in block content and record media fields. |