Corporate services (CSP)

The csp.* family (33 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.

Createcsp.address.create

workspace_id from ctx.

Call POST /v/csp.address.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.address.create.

Updatecsp.address.update

Partial patch fenced by workspace_id.

Call POST /v/csp.address.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.address.update.

Createcsp.bankAccount.create

Fence entityId in ctx.workspace_id (no workspace_id column).

Call POST /v/csp.bankAccount.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.bankAccount.create.

Deletecsp.bankAccount.delete

Fence via parent entity in ctx.workspace_id.

Call POST /v/csp.bankAccount.delete with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.bankAccount.delete.

Updatecsp.bankAccount.update

Fence via parent entity in ctx.workspace_id.

Call POST /v/csp.bankAccount.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.bankAccount.update.

Degradecsp.complianceObligation.degrade

Only (cron). The time-based status machine for ctx.workspace_id: UPCOMING->WARNING (warning_date<=now), WARNING->DUE (due_date<=now), DUE->OVERDUE (past the grace window). Returns changed ids per stage. Idempotent. BEARERLESS - DEFERRED.

Call POST /v/csp.complianceObligation.degrade with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Updatecsp.complianceObligation.update

User status transition (COMPLETED|WAIVED|NOT_APPLICABLE).

Call POST /v/csp.complianceObligation.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.complianceObligation.update.

Upsertcsp.complianceObligation.upsert

Conflict key (entity_id, obligation_type, period_year).

Call POST /v/csp.complianceObligation.upsert with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.complianceObligation.upsert.

Createcsp.entity.create

workspace_id from ctx.

Call POST /v/csp.entity.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.entity.create.

Updatecsp.entity.update

Partial patch fenced by workspace_id (direct column).

Call POST /v/csp.entity.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.entity.update.

Createcsp.entityEvent.create

Immutable append-only change log. workspace_id from ctx.

Call POST /v/csp.entityEvent.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.entityEvent.create.

Mark Dispatchedcsp.entityEvent.markDispatched

Only. Flip notifications_dispatched=true (idempotent). BEARERLESS bookkeeping - DEFERRED.

Call POST /v/csp.entityEvent.markDispatched with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Purgecsp.entityPresence.purge

Only. COURT-GATED cross-workspace: deletes presence rows for the given custodian workspace ids (revoke + org-teardown cascade). BEARERLESS - DEFERRED (built, not wired).

Call POST /v/csp.entityPresence.purge with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Upsertcsp.entityPresence.upsert

Only (background-computed). custodian_workspace_id IS the RLS root (must equal ctx.workspace_id). Conflict key (global_identity_id, custodian_workspace_id). BEARERLESS.

Call POST /v/csp.entityPresence.upsert with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Createcsp.individual.create

(DOB/PII). workspace_id from ctx.

Call POST /v/csp.individual.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.individual.create.

Updatecsp.individual.update

(pepStatus/sourceOfWealth). Partial patch fenced by workspace_id.

Call POST /v/csp.individual.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.individual.update.

Createcsp.kycDocument.create

Exactly-one-holder, fenced in ctx.workspace_id. Unique file_record_id -> Conflict (the extraction caller catches + falls back to update).

Call POST /v/csp.kycDocument.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.kycDocument.create.

Deletecsp.kycDocument.delete

Fence via the holder in ctx.workspace_id.

Call POST /v/csp.kycDocument.delete with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.kycDocument.delete.

Expiry Sweepcsp.kycDocument.expirySweep

Only (cron). For ctx.workspace_id: valid -> expiring_soon (expiry within warningDays) and valid|expiring_soon -> expired (past expiry). Returns the changed ids so the frontend emits the per-row compliance events. Idempotent (predicated). BEARERLESS - DEFERRED.

Call POST /v/csp.kycDocument.expirySweep with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Updatecsp.kycDocument.update

Fence via the holder in ctx.workspace_id.

Call POST /v/csp.kycDocument.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.kycDocument.update.

Upsertcsp.kycDocument.upsert

INSERT ON CONFLICT(file_record_id). Fence holder in workspace.

Call POST /v/csp.kycDocument.upsert with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.kycDocument.upsert.

Createcsp.obligationRule.create

workspace-owned rule (workspace_id from ctx).

Call POST /v/csp.obligationRule.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.obligationRule.create.

Seedcsp.obligationRule.seed

Only. COURT-GATED: writes workspace_id=NULL global SYSTEM rules (cannot fence on ctx.workspace_id). Idempotent upsert keyed (workspace_id IS NULL, jurisdiction, obligation_type, entity_types). SYSTEM/genesis principal. BEARERLESS - DEFERRED (built, not wired).

Call POST /v/csp.obligationRule.seed with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Updatecsp.obligationRule.update

Fence workspace_id = ctx (REFUSE the NULL-workspace SYSTEM rules, mirroring the route 403). Soft-delete = isActive

Call POST /v/csp.obligationRule.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.obligationRule.update.

Approvecsp.riskAssessment.approve

Atomic PENDING -> APPROVED.

Call POST /v/csp.riskAssessment.approve with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.riskAssessment.approve.

Createcsp.riskAssessment.create

Score/rating computed by the caller and passed in.

Call POST /v/csp.riskAssessment.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.riskAssessment.create.

Rejectcsp.riskAssessment.reject

Atomic PENDING -> REJECTED.

Call POST /v/csp.riskAssessment.reject with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.riskAssessment.reject.

Updatecsp.riskAssessment.update

PENDING-only edit (precondition guard moved into the verb).

Call POST /v/csp.riskAssessment.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.riskAssessment.update.

Createcsp.role.create

Fence entityId AND the holder (individual/holderEntity) in ctx.workspace_id.

Call POST /v/csp.role.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.role.create.

Deletecsp.role.delete

Hard-delete fenced via parent entity in ctx.workspace_id.

Call POST /v/csp.role.delete with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.role.delete.

Createcsp.sourceOfFunds.create

Exactly-one subject, fenced in ctx.workspace_id.

Call POST /v/csp.sourceOfFunds.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.sourceOfFunds.create.

Deletecsp.sourceOfFunds.delete

Fence via subject in ctx.workspace_id.

Call POST /v/csp.sourceOfFunds.delete with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.sourceOfFunds.delete.

Updatecsp.sourceOfFunds.update

Fence via subject in ctx.workspace_id.

Call POST /v/csp.sourceOfFunds.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool csp.sourceOfFunds.update.