Entity Records (gated read/write)

⚡ Built-in — Platform Built-in

Read and write MAPI entity records from a page, under the visitor or member identity of the current session. Only works on entities that carry an access policy (policy_json) — the policy decides which rows the caller sees, which fields are returned, and who may create, update or delete. The owner column is set server-side from the session; fields listed in fields.<tier>.hide or fields.<tier>.readonly cannot be written. Use this for member areas, own requests, notes, messages and other per-user or per-tenant data that must not be public.

⚡ Built-in — No Setup Required This integration is built into the WebsitePublisher platform. All endpoints are available immediately — no API key needed.

Endpoints (5)

POST list

List records of a governed entity, scoped to the caller by the entity policy. Returns { entity, data, pagination }. Requires a verified SAPI session (visitor magic link/code, or a tenant_auth wst_ Bearer). Entities without a policy_json return 404.

Field	Type	Required	Description
`entity`	string	✓ Yes	Entity name, e.g. iteration_log.
`filter`	object	No	Equality filters, e.g. {"published":1}. Cannot widen scope — the policy filter is applied on top. Fields hidden by the policy cannot be filtered on.
`sort_by`	string	No	Column to sort on (default id). Fields hidden by the policy cannot be sorted on.
`sort_order`	string	No	ASC or DESC (default ASC).
`per_page`	integer	No	Page size (default 50, max 200).
`offset`	integer	No	Pagination offset (default 0).

POST get

Read one record of a governed entity by id. Returns { entity, data }. A record the caller does not own returns 403; an unknown record, an unknown entity, or an entity without a policy returns 404.

Field	Type	Required	Description
`entity`	string	✓ Yes	Entity name, e.g. iteration_log.
`id`	integer	✓ Yes	Record id.

POST create

Create a record in a governed entity as the signed-in visitor or tenant member. The policy must allow create for that caller (rules.create, e.g. {"verified":"self"}). The owner column is set from the session; id, the owner column, hidden and readonly fields are refused (422). Returns { entity, id }. Requires a verified SAPI session.

Field	Type	Required	Description
`entity`	string	✓ Yes	Entity name, e.g. withdrawal_request.
`data`	object	✓ Yes	Field => value (scalars, max 50 fields).

POST update

Update fields of a record the caller may change (rules.update, e.g. {"verified":"own"}). Ownership and state guards are checked on the existing row; the owner column cannot be changed; hidden and readonly fields are refused (422). Returns { entity, id }.

Field	Type	Required	Description
`entity`	string	✓ Yes	Entity name.
`id`	integer	✓ Yes	Record id.
`data`	object	✓ Yes	Only the fields that change (scalars, max 50 fields).

POST delete

Delete a record the caller may delete (rules.delete). Hard delete; a state guard in the policy (guards.delete) can block it with 409. Returns { entity, id }.

Field	Type	Required	Description
`entity`	string	✓ Yes	Entity name.
`id`	integer	✓ Yes	Record id.

MCP Tool Names

When using this integration through an AI assistant (Claude, ChatGPT, Cursor, etc.), the endpoints are available as MCP tools:

Endpoint	MCP Tool Name
list	`records_list`
get	`records_get`
create	`records_create`
update	`records_update`
delete	`records_delete`

← Back to all integrations