The orgAddon.* family (3 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
CreateorgAddon.create
| Property | Value |
|---|---|
| Capability | other.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
Install (or restore) an org addon (workspace_id from ctx). status
defaults ACTIVE. installed_by_id = OPTIONAL installedById (guarded) else the acting user (NOT NULL ->
a seat with no user and no installedById is refused). Unique (workspace_id, addon_key) -> Conflict.
Call POST /v/orgAddon.create with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
DeleteorgAddon.delete
| Property | Value |
|---|---|
| Capability | other.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
Hard delete by id + workspace fence (idempotent; the uninstall path).
Call POST /v/orgAddon.delete with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
UpdateorgAddon.update
| Property | Value |
|---|---|
| Capability | other.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
Partial PATCH by id + workspace fence (status/config/provisionedData/ disabledAt). Sets updated_at = now().
Call POST /v/orgAddon.update with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.