Organisation

The org.* family (30 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.

Createorg.agent.create

Mints a roster AGENT actor (kind=AGENT, role set, reports_to = the lattice parent), a bound API key (REUSE the convene seat-key mint), and a persistent agent_grant row (⊆ the creator’s grant). The lattice guards (ADR-0026 §6) are checked fail-closed BEFORE any write; the uq_org_single_cos / ck_actor_reports_to_not_self constraints are the DB backstops.

Input { role, reportsTo?, displayName?, soulRef?, spec?, agentId?, autonomy?, capabilityScope?, orgPack?, ttlSecs? } (fields ending in ? are optional)

Call POST /v/org.agent.create with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Disableorg.agent.disable

The REVERSIBLE bench of a roster agent - flips actor.status ACTIVE/DISABLED (migration 0038). A DISABLED agent is denied at the AuthContext resolver (status != 'ACTIVE', auth.rs §6 / ADR-0040 §6) exactly like a REVOKED one, so it cannot act - but its identity, bound keys, and grant SURVIVE untouched (unlike org.agent.remove, which terminally REVOKEs + kills the keys). enable:true re-enables (DISABLED->ACTIVE). The guards mirror the lattice (ADR-0026 §6): no self-disable (no self-lockout); the immortal CoS cannot be disabled (it is the org root); a REVOKED node is terminal (cannot be disabled/enabled). RLS-scoped.

Input { agentId, enable? } (fields ending in ? are optional)

Call POST /v/org.agent.disable with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool org.agent.disable.

Getorg.agent.get

One roster node (role + reports_to + soul_ref) + its grant. IDOR-scoped to the workspace (predicate + RLS).

Input { agentId } (fields ending in ? are optional)

Call POST /v/org.agent.get with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Listorg.agent.list

One SELECT over actor (role IS NOT NULL) LEFT-JOIN agent_grant - the recursive walk over the single actor table (no second org-edge store, steering #1). IDOR-scoped to the workspace (predicate + RLS backstop): ws B never sees ws A’s roster.

Input { reportsTo?, role? } (fields ending in ? are optional)

Call POST /v/org.agent.list with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Moveorg.agent.move

Re-parents agentId under newParentId: the new parent is the CoS or a HEAD; the moved node’s role stays valid under it (head→worker-only preserved); NO cycle (the moved subtree cannot contain the new parent - walked over reports_to); the CoS cannot move (it is the immortal root).

Input { agentId, newParentId } (fields ending in ? are optional)

Call POST /v/org.agent.move with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Promoteorg.agent.promote

(role in HEAD|WORKER). WRITE/ADMIN. Moves a roster node between the HEAD and WORKER tiers while keeping the lattice valid (ADR-0026 §6 head->worker-only). NEVER mints a 2nd CoS (role=COS is rejected - the immortal single CoS is seeded, never promoted into; uq_org_single_cos is the DB backstop) and NEVER demotes the existing CoS (it is the immortal root). The placement guard re-checks the node’s CURRENT parent under the NEW role: a HEAD reports to the CoS (so promoting a WORKER->HEAD requires its parent to BE the CoS); a WORKER reports to a CoS-or-HEAD (always satisfied by an existing HEAD’s parent). RLS-scoped.

Input { agentId, role } (fields ending in ? are optional)

Call POST /v/org.agent.promote with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool org.agent.promote.

Removeorg.agent.remove

Terminally REVOKEs a roster node (status=REVOKED - never a hard DELETE, so the audit chain + FKs survive). NO self-removal; removing a HEAD is CoS-only; a node with WORKERS is REFUSED (reassign them first via org.agent.move) - the no-orphan guard, backed by the reports_to ON DELETE RESTRICT FK. The CoS cannot be removed (immortal single CoS).

Input { agentId } (fields ending in ? are optional)

Call POST /v/org.agent.remove with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Setorg.ai-risk.set

: set the org’s EU AI Act risk tier ([2026] VJS-CC-OPBOX 106, the classification keystone; Art.6(2) / Art.43). HIGH = an Annex III regulated use (visa/legal/HR); LIMITED = a non-Annex-III AI use (the Art.50 transparency tier); MINIMAL = no material AI decisioning. A recorded, INV-8-audited GOVERNANCE fact read via org.get - the LOCK the later oversight + FRIA gates hang from; it binds NOTHING in dispatch in this keystone. HUMAN-path (AdminOnly - no MCP-agent self-classification). An optional justification rides the audited input (the analyst’s reason for the tier). Re-settable: a HIGH->LIMITED downgrade is INV-8 audited, never silently overwritten (the chain is the history).

Call POST /v/org.ai-risk.set with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Deleteorg.aiConfig.delete

OWNER (DEFERRED court-gated). Delete the org’s AI config row; idempotent. { organizationId }.

Call POST /v/org.aiConfig.delete with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Upsertorg.aiConfig.upsert

(DEFERRED court-gated AI-credential). 1:1 (organization_id) upsert. Stores already-encrypted blobs + the openclaw bearer HASH. Set-if-present (COALESCE) merge. Mints aicfg_.

Call POST /v/org.aiConfig.upsert with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Feedorg.audit.feed

/OVERSEER: read the audit/event log ACROSS the org’s workspaces (C1). Same OVERSEER arming as org.gate.list; the 0063 event RLS OR-limb returns cross-workspace events. Each event carries its workspaceId so the overseer sees which workspace it came from.

Call POST /v/org.audit.feed with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool org.audit.feed.

Setorg.byok.set

(DEFERRED court-gated). Superadmin BYOK policy toggle. { orgId, allowOwnAiKeys }.

Call POST /v/org.byok.set with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Deleteorg.delete

(DEFERRED court-gated). Irreversible hard delete of the FRONTEND organizations row (the FK cascade clears child config). The frontend pre-flight (Restrict-FK clears + audit archive) stays in place. Idempotent: rows_affected 0 -> changed

Call POST /v/org.delete with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Listorg.dpia.list

: the org’s registered DPIAs (the read-home).

Call POST /v/org.dpia.list with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool org.dpia.list.

Registerorg.dpia.register

: register a Data Protection Impact Assessment (GDPR Art.35). Unlike the FRIA it does NOT gate dispatch (CC-OPBOX 106) - a documentation + audit fact. The tenant (controller) authors the content; Opbox holds the auditable register.

Call POST /v/org.dpia.register with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Freezeorg.freeze

Mass-disable agents + bump all sessions (reversible). { reason? }. Composes org.agent.disable(emergency) (mass) + session.revoke (org-wide). One parent ops_event + the per-child counts. Does NOT touch HUMAN actors’ status (they keep working; only their sessions bump).

Call POST /v/org.freeze with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Listorg.gate.list

/OVERSEER: list gates ACROSS the org’s workspaces (the membership-gated oversight read, C1). No workspace_id = $1 predicate - the 0063 RLS OR-limb returns the org’s cross-workspace gates once oversight is armed. Each gate carries its workspaceId so the overseer sees where it lives.

Call POST /v/org.gate.list with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool org.gate.list.

Getorg.get

: the caller’s organisation record (the per-box tenant root + the 2FA policy). [2026] VJS-CC-OPBOX 105: the org is kernel SoR; the frontend reads it via this verb, not Prisma.

Call POST /v/org.get with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool org.get.

Listorg.list

: the organisation(s) on this box (one per box, ADR-0004) - the box-level read the control plane + a super-tenant operator use. [2026] VJS-CC-OPBOX 105.

Call POST /v/org.list with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool org.list.

Lockdownorg.lockdown

org.freeze + freeze external egress (EgressPolicy deny-all) + the token scope-fan. { reason? }. The maximal reversible cut short of tenant.suspend (≠ org.halt / ≠ tenant.suspend). One parent ops_event + per-child counts; reversible.

Call POST /v/org.lockdown with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Setorg.managedHost.set

(DEFERRED court-gated). Superadmin managed-host / reseller-markup. Partial: only provided fields written. { orgId, host?, resellerMarkupPct?|null }.

Call POST /v/org.managedHost.set with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Listorg.membership.list

: the org’s memberships (OWNER/ADMIN read all via the 0063 manage path).

Call POST /v/org.membership.list with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Removeorg.membership.remove

: remove an actor’s org membership (refuses the sole OVERSEER).

Call POST /v/org.membership.remove with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Setorg.membership.set

: set an actor’s org role (MEMBER | OVERSEER). HUMAN-only (CC-OPBOX 49).

Call POST /v/org.membership.set with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Setorg.security.set

: set the org’s 2FA mandate ([2026] VJS-CC-OPBOX 105 Phase B). The access-control policy is now a kernel GOVERNANCE fact (INV-8 audited), not a UI-optional Prisma column - GDPR Art.32(1)(b). Within CC-OPBOX 102/65; no fresh trust boundary.

Call POST /v/org.security.set with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Createorg.trustedIdp.create

Only (DEFERRED court-gated). Register a trusted login IdP. { orgId, label, issuer, jwksUrl, jwksDocument?, subjectMapping? }. jwks_fetched_at stamped now when a jwksDocument is supplied. Mints otidp_.

Call POST /v/org.trustedIdp.create with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Deleteorg.trustedIdp.delete

Only (DEFERRED court-gated). Fenced id+org; idempotent. { idpId, orgId }.

Call POST /v/org.trustedIdp.delete with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Updateorg.trustedIdp.update

Only (DEFERRED court-gated). Partial PATCH fenced id+org. { idpId, orgId, label?, issuer?, jwksUrl?, jwksDocument?, subjectMapping?, active? }. jwks_fetched_at re-stamped when a jwksDocument is present.

Call POST /v/org.trustedIdp.update with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Updateorg.update

: rename the per-box organisation.

Call POST /v/org.update with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Upsertorg.upsert

(DEFERRED bearerless provisioning). Idempotency key = slug. INSERT … ON CONFLICT (slug) DO NOTHING then re-read. { slug, name }. Returns { id, slug, idempotent }.

Call POST /v/org.upsert with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool org.upsert.