The team.* family (7 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Archiveteam.archive
| Property | Value |
|---|---|
| Capability | team.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
Soft-archives a team (sets archived_at). An archived team can no longer be granted (acl.grant rejects an archived grantee); existing team grants resolve through its membership only while the rows exist - archiving is the management off-switch. Idempotent.
Input { teamId } (fields ending in ? are optional)
Call POST /v/team.archive with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Createteam.create
| Property | Value |
|---|---|
| Capability | team.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | On demand (MCP tier 2) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
Mints a team in the caller’s workspace. The unique (workspace,name)
makes a duplicate name a friendly Conflict (the 0024 landmine key).
Input { name, color? } (fields ending in ? are optional)
Call POST /v/team.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool team.create.
Getteam.get
| Property | Value |
|---|---|
| Capability | team.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | On demand (MCP tier 2) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
One team + its members. A not-found team is a BadInput (a team is a workspace-internal object, not a confidential per-actor one - no anti-enum needed here).
Input { teamId } (fields ending in ? are optional)
Call POST /v/team.get with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool team.get.
Listteam.list
| Property | Value |
|---|---|
| Capability | team.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | On demand (MCP tier 2) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
Lists the workspace’s teams + member counts. Excludes archived
unless includeArchived: true.
Input { includeArchived? } (fields ending in ? are optional)
Call POST /v/team.list with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool team.list.
Addteam.member.add
| Property | Value |
|---|---|
| Capability | team.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | On demand (MCP tier 2) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
role ∈ {LEAD, COLLEAGUE} (default COLLEAGUE). WRITE/ADMIN. Adds an actor to a (live) team. The member gains the team’s grants on its NEXT call (resolved at read time). Upserts (re-adding updates the role). The team + actor must both live in this workspace.
Input { teamId, actorId, role? } (fields ending in ? are optional)
Call POST /v/team.member.add with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool team.member.add.
Removeteam.member.remove
| Property | Value |
|---|---|
| Capability | team.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | On demand (MCP tier 2) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
Removes an actor from a team; the actor loses the team’s grants on its NEXT call (resolved at read time - instant revocation). Idempotent: removing a non-member is a no-op success.
Input { teamId, actorId } (fields ending in ? are optional)
Call POST /v/team.member.remove with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool team.member.remove.
Renameteam.rename
| Property | Value |
|---|---|
| Capability | team.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Admin |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
Renames and/or recolors. A not-found team is a BadInput.
Input { teamId, name?, color? } (fields ending in ? are optional)
Call POST /v/team.rename with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.