Change requests

The change-request.* family (7 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.

change-request.comment.add

change_request.comment_add - WRITE/ADMIN. { changeRequestId, body }. Adds a comment; the parent CR must resolve where workspace_id = ctx.workspace_id OR overseer_org_id = ctx.workspace_id (origin OR overseer side). author_id is the acting user. NB: change_request_comments has NO updated_at column.

Call POST /v/change-request.comment.add with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool change-request.comment.add.

change-request.create

change_request.create - WRITE/MEMBER. { overseerWorkspaceId, type, resourceType, resourceId?, resourceTableId?, changeset, title, description? }. The SUBORDINATE (ctx.workspace_id) files a PENDING request; requested_by_id is the acting user. overseer_org_id = overseerWorkspaceId (a workspace id).

Call POST /v/change-request.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool change-request.create.

change-request.linkMatter

change_request.link_matter - WRITE/MEMBER. { id, matterId, description? }. Links the APR matter to a CR (overseer side): sets matter_id + description where id AND overseer_org_id = ctx.workspace_id; the matter must resolve in the overseer workspace. rows_affected==0 -> BadInput. (Deferred: system-seat path.)

Call POST /v/change-request.linkMatter with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool change-request.linkMatter.

change-request.redactChangesets

change_request.redact_changesets - WRITE/ADMINONLY (retention cron). { cutoffIso }. Bulk-redacts the changeset JSON to {redacted

Call POST /v/change-request.redactChangesets with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

change-request.reject

change_request.reject - WRITE/ADMIN. { id, reviewNote? }. The OVERSEER rejects a single PENDING request: PENDING -> REJECTED where id AND overseer_org_id = ctx.workspace_id. reviewed_by_id is the acting user. rows_affected==0 -> re-read to throw the EXACT existing messages.

Call POST /v/change-request.reject with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool change-request.reject.

change-request.withdraw

change_request.withdraw - WRITE/MEMBER. { id }. PENDING -> WITHDRAWN by id, fenced workspace_id = ctx.workspace_id (the subordinate side). Not-found -> BadInput; non-PENDING -> Conflict.

Call POST /v/change-request.withdraw with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool change-request.withdraw.

change-request.withdrawForRelationship

change_request.withdraw_for_relationship - WRITE/ADMIN. { subordinateWorkspaceId, reviewNote }. The OVERSEER bulk-withdraws PENDING requests for rows where overseer_org_id = ctx.workspace_id AND workspace_id = subordinateWorkspaceId. Returns { count }.

Call POST /v/change-request.withdrawForRelationship with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool change-request.withdrawForRelationship.