The acroform.* family (1 verb). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Fillacroform.fill
| Property | Value |
|---|---|
| Capability | form.fillpdf |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Member |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
{ fileId, fieldMap: { name: value, ... }, requiredFields?, filename? }. The fieldMap is CALLER
config (a tenant’s per-form field-map). Sets /V on each named widget + the catalog
/NeedAppearances so a viewer renders the values. GENERIC - no form is hardcoded.
INV-9 coverage gate: requiredFields (config) names widgets that MUST be filled; a required widget
with no meaningful value BLOCKS (fail-closed) - never a silently-incomplete government form. The
output is a NEW file_record (origin=FILL, source = [the template]), encrypted (INV-7). The filled
File inherits the template’s sensitivity (a filled gov form carries PII).
Call POST /v/acroform.fill with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.