The pref.* family (3 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Getpref.get
| Property | Value |
|---|---|
| Capability | actor.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
Read the CALLING actor’s UI preference for a key (24-dashboards server
persistence). Actor-scoped (self-read); the value is null when unset. NON-secret view prefs only - the
per-user, Member-writable companion to the workspace/Owner config store. { key } -> { key, value }.
Call POST /v/pref.get with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool pref.get.
Listpref.list
| Property | Value |
|---|---|
| Capability | actor.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
The calling actor’s UI prefs, optionally filtered to a keyPrefix
(actor-scoped, RLS-fenced - identical scoping to pref.get). ONE round trip replaces the N+1 of a
pref.get per key (the NotificationBell muted-set load: one call, not one-per-kind). Returns
{ prefs: [{ key, value }], count }. NON-secret view prefs only.
Call POST /v/pref.list with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool pref.list.
Setpref.set
| Property | Value |
|---|---|
| Capability | actor.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
Upsert the CALLING actor’s UI preference for a key (self-write, actor-scoped).
The first consumer is the dashboard widget layout (24). NON-secret view prefs only. { key, value }.
Call POST /v/pref.set with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool pref.set.