List the workspace's pages (id, name, slug, published), optionally filtered by a search string.

Get one page's full details (blocks, layout, page type, custom fields, and the SEO title/description/display name per language) by id or slug. Use when the user asks about a specific page's content, structure or SEO.

Get the workspace's site configuration: languages, site name, enabled features, and the cart/commerce settings (currency, tax rates, shipping methods).

List the block types available on the workspace's site, each with its content field schema and default values. Use a block type's schema to shape content for add_block_to_page / update_block_content / patch_block_content - content is language-keyed ({ en: { fieldKey: value } }), and a relation field stores record id(s) per its relationTo/relationType. A non-empty layoutRegions marks a layout block (header/footer) managed via update_page_layout, not page body blocks.

Show where each block type is stored across the workspace: draft and published page blocks, layout regions (draft and published) and developer drafts, with per-surface counts and the pages that hold it. registered says whether the active block manifest still declares the type; orphanTypes lists types stored but no longer registered (the site renders nothing for them), unusedTypes lists registered types no page uses. Use it before renaming or removing a block type in code, then migrate or remove the instances it lists with update_block_content / remove_block_from_page.

Get the current workspace's info: name, slug, plan and limits (max pages, users, storage, AI tokens).

List media files (images and files) in the workspace; paginated.

Upload a file to the workspace media library from a local path or a remote URL (max 50MB; images, video, audio, PDF and common office documents). Returns the stored asset whose url can be used in block content and record media fields.

List media folders in the workspace (optionally under a parent folder). Use this to discover a folderId before uploading or moving assets.

Create a media folder for organizing assets. Returns the folder, whose id can be passed to upload_media (folderId) or move_media. Only call after the user agreed to the folder you described.

Rename a media folder and/or move it under a different parent folder. Only call after the user agreed to the change.

Delete a media folder. By default only empty folders are removed; pass deleteContents to also delete the assets inside, and force to override the refusal that protects assets still in use. Only call after the user explicitly confirmed the deletion.

Move one or more media assets into a folder (or to the root with folderId: null). Use list_media_folders to find the destination folderId.

List the people in this workspace with their role and status (active, suspended, or a pending invitation). Read-only; filter by status or a search string; paginated.

List the roles defined in this workspace and the permissions each one grants. Read-only. Useful for understanding who can do what.

Create a new draft page with a name and slug (content/blocks are added later in the editor). Optional: parentId, pageType, multilingual displayName/seoTitle/seoDescription, customFields. Only call AFTER the user explicitly agreed.

Set the full content blocks array on a page (replaces all existing content blocks). Blocks with matching ids keep their existing content when not provided. Only call after the user confirms. If the result includes blockWarnings, the saved content violates the workspace block manifest (unknown block type, unknown field or wrong value shape) - correct the content and save again.

Promote YOUR per-user dev draft overlay onto the page's shared draft (replaces the shared draft blocks; the overlay belongs to the token's user). Do this after the block code for the composed types is deployed to the site. Fails when you have no dev draft for the page. If the result includes blockWarnings, the promoted content violates the workspace block manifest - correct the content and save again. Only call after the user confirms.

Update page metadata: name, slug, display name, SEO fields and custom fields. Only the languages and fields you pass change - the ones you omit keep their current values. Only call after the user confirms.

List the workspace's page types (templates) with their id, name, slug and url prefix.

Create a page type (template) with a custom-field schema. Pages of this type carry these custom fields. Only call after the user confirms.

Get one page type with its full custom-field schema - the field keys, types and options that pages of this type carry in customFields, and for relation fields their relationTo / relationType. Use before writing customFields on a page, because list_page_types does not return the fields.

Update a page type: name, slug, icon, url prefix, allowChildren, or its custom-field schema. Fields you omit keep their current value, EXCEPT fields, which replaces the whole schema. Only call after the user confirms.

Delete a page type. Refused for system types and for a type any page still uses - move or delete those pages first. Only call after the user explicitly confirms.

Publish a page (or re-publish with the latest draft changes). Publishes both content and layout. Only call after the user confirms.

Unpublish a published page (toggles its published state off). Only call after the user confirms.

Take over the edit lock on a page another editor is holding open, so the next write (publish_page, update_page_blocks, update_page_layout, ...) is not refused with PAGE_LOCKED. The previous holder is bounced to read-only and may lose unsaved work, so only call after the user confirms. Needs pages:edit or pages:publish on the page.

Discard all draft changes and revert a page to its last published version. Only call after the user confirms.

Permanently delete a page and all its descendants. Cannot delete the homepage. Only call after the user explicitly confirms.

Update page-level layout: inheritance, overrides, or replace all layout blocks. Only call after the user confirms. If the result includes blockWarnings, the saved content violates the workspace block manifest (unknown block type, unknown field or wrong value shape) - correct the content and save again.

Set the settings of one layout region on a page, e.g. a sidebar's width or a header's variant. Reads the page's current region settings, replaces only the named region and writes the whole list back (page.updateLayout with layoutRegionSettings, one version-guarded write); entries for regions or keys the manifest no longer declares are pruned on the way. Values are validated against the workspace layout manifest's region settings schema: an unknown region, an unknown key, or non-empty values on a region that declares no settings (such a region accepts {} only) is rejected with the backend's BAD_USER_INPUT message. Child pages inherit the region's settings unless they set their own (see get_page.resolvedRegions).

Add a block to a page (auto-generates the block id). Pass layoutRegion to add a layout block; omit it for a content block in the page body. Only call after the user confirms. If the result includes blockWarnings, the saved content violates the workspace block manifest (unknown block type, unknown field or wrong value shape) - correct the content and save again.

Update a specific block's content on a page. Defaults to merging with existing content; pass mode: 'replace' to overwrite the block's whole content. Works for content and layout blocks. Only call after the user confirms. If the result includes blockWarnings, the saved content violates the workspace block manifest (unknown block type, unknown field or wrong value shape) - correct the content and save again.

Apply surgical HTML edits (insert_before/insert_after/replace_section) to a block's localized content string without re-sending the full content. Each op's marker must match exactly once. Only call after the user confirms. If the result includes blockWarnings, the saved content violates the workspace block manifest (unknown block type, unknown field or wrong value shape) - correct the content and save again.

Remove a specific block from a page by its instance id. Works for content and layout blocks. Only call after the user confirms.

List the forms in the workspace. Filter by status; paginated.

Get one form's full details (fields, settings, submission count) by id or slug.

Create a new form with a name and slug. Optional: field definitions and settings (action type, notifications, webhook, captcha). Fields can also be added later in the Forms editor. Only call AFTER the user explicitly agreed.

Update an existing form's name, slug, status, fields or settings (partial). Only call after the user describes the change and confirms.

Permanently delete a form and all its submissions. Only call after the user explicitly confirms.

List form submissions, optionally filtered by form and status; paginated. Returns submission rows with their data and status.

Get one form submission's full details by its id.

Update a form submission's status (pending, processed, spam, archived).

Permanently delete a form submission. Only call after the user explicitly confirms.

List the data models (content types) defined in the current workspace. Use to answer 'do we have models / a Product model?' or to see what data structures already exist.

Get the full details of one data model by id or slug: complete field definitions (type, options, relations, validation) and the product capability config (enabled, price/sku/inventory field mapping, variantAxes). Use before update_model and when the user asks about a model's structure.

Create a data model in the workspace. Field types include select/multiselect (provide options), relation (link to another model via relationTo = the target model's slug + relationType), and object/list (nested fields/itemFields). Optional model-level config: slug, description, icon, color, displayField, defaultSort, statusField, product (commerce capability: enabled, priceField, skuField, inventoryField, variantAxes), uniqueFields (field keys whose value must be unique - lets import_records update by that key) and deliveryAccess - a model is "none" (admin only) by default, so pass "public" when the user's app must read it through the delivery API. Only call AFTER the user has explicitly agreed to a structure you proposed (e.g. replied yes / clicked 'Yes, create'). Never create without that explicit go-ahead.

Update a data model by id or slug: name, slug, description, icon, color, displayField, defaultSort, statusField, fields, product capability config, uniqueFields (replaces the whole list; refused while records already share a value), or deliveryAccess ("public" lets the user's app read the model through the delivery API; "none" is admin only). fields is a PATCH - listed fields are added or replaced by key, unlisted fields stay untouched; use removeFields to delete fields. product is also a PATCH of the commerce capability config (enabled, priceField, skuField, inventoryField, variantAxes) - omitted keys keep their stored values. Only call AFTER the user explicitly agreed to the change.

Delete a data model. WARNING: this cascades - ALL records of the model are permanently deleted. Only call after the user explicitly confirms.

List the records (entries) of a data model, by the model's id or slug. Supports filtering (per key: scalar equality, $in, $gte/$lte, $regex), sort, and pagination. Each record includes its full data, so you can find a record by a field value (e.g. sku) without extra lookups.

Get one record (entry) of a data model by its id, including all its field values and status.

Add a record (entry) to a data model. Pass the model id or slug and a data object whose keys are the model's field keys (use get_model first if unsure). Only call AFTER you described the record and the user explicitly agreed; never create without that go-ahead.

Update an existing record by id (from list_records). Pass data to merge field values (fields you don't pass are unchanged), and/or status to transition the record's lifecycle state. At least one of data/status is required. Only call AFTER you described the change and the user explicitly agreed.

Permanently delete one record (entry) by its id. Only call after the user explicitly confirms. A record still used by page blocks is refused: report the listed pages back to the user and retry with force: true only once they confirm the reference may go stale.

Bulk-import records into a data model (up to 1000 rows). Without upsertKey each row CREATES a record; with upsertKey (a unique field or the product SKU field) a row matching an existing record UPDATES it instead, so a repeated sync does not duplicate. A translatable field takes a language map ({ title: { en: '...', no: '...' } }); a language the workspace has not enabled is rejected. Returns importedCount (created), updatedCount, per-row errors, and per-row record ids with CREATED / UPDATED / UNCHANGED.

List orders in the workspace. Filter by payment/fulfillment status, customer, pipeline stage, a search string, or a date range; paginated.

Get one order's full details by its id: items, the full money column (subtotal, discount, shipping, tax, total - all minor units), the frozen discount code, PO number, shipping address and payment/fulfillment status.

Get the workspace order pipeline (the configurable stages orders move through).

Create a manual (admin-entered) order. Each item references a product recordId or is an ad-hoc line with name+price (minor units). Only call after the user confirms.

Replace an order's line items (full replace of the items array). Recomputes totals. Only call after the user confirms.

Update order metadata: customer email, internal notes, shipment tracking, PO number and delivery address. Only provided fields change.

Record a full payment for an order (manual reconciliation - does NOT verify with a payment provider). amount is in minor units. Only call after the user confirms.

Record a (possibly partial) payment against an order's outstanding balance. amount is in minor units and capped at the balance due. Only call after the user confirms.

Refund an order. Omit amount for a full refund; pass amount (minor units) for a partial refund. Only call after the user confirms.

Cancel an order. Only call after the user confirms.

Move an order to a new fulfillment status. Optionally attach tracking when marking fulfilled. Only call after the user confirms.

Move an order to a pipeline stage (use get_order_pipeline for valid stage ids).

Attach an invoice (number, optional URL and provider) to an order.

List shopping carts (admin view) with optional status filter and pagination. totalValue is in minor units.

List discount codes in the workspace. Filter by enabled, type, or a code search; paginated.

Get one discount's full details (type, value, usage limits, validity window) by id or code.

Create a discount code. type is 'percentage' (value 0-100), 'fixed' (value in minor currency units, requires currency e.g. 'USD'), or 'free_shipping' (value 0). Optional limits: minSubtotal, maxUses, startsAt, endsAt. Only call AFTER the user explicitly agreed to the code you described.

Update a discount (partial). code/type/currency become immutable once the discount has been used. Only call after the user confirms.

Enable or disable a discount code.

List a product model's catalog with stock and variant info (onHand/reserved/available per record and variant).

Bulk-update selected product records with a single patch (status, set/adjust stock, set/adjust price). Stock is units; price is minor units. Only call after the user confirms.

Bulk-delete selected product records permanently. Only call after the user explicitly confirms.

Set the record-level volume price breaks on a product (B2B quantity discounts). They price the product and every variant that defines no breaks of its own; a variant's own breaks are part of its definition, so set those with the variants payload. A line's unit price steps down to the highest break its quantity reaches, and the cart and the order both charge that price. Prices are minor units. Passing an empty array removes the breaks.

Configure the workspace's commerce settings: currency, whether prices include tax, tax rates, shipping methods and stock thresholds. Only provided fields change; arrays replace the whole list.

Remove the workspace's commerce settings entirely, putting the cart back to never-configured. Only call after the user explicitly confirms. A workspace with orders or carts is refused: report that back to the user and retry with force: true only once they confirm. To change individual settings rather than remove them, use update_cart_config.

List the workspace's webhook endpoints (signing secrets are never returned here).

List recent webhook delivery attempts (status: pending/success/failed) for debugging.

List the event types a webhook can subscribe to (the authoritative allowlist).

Create a webhook endpoint subscribed to one or more events. The URL must be a public https endpoint. Returns the endpoint AND its signing secret (shown only once). Only call after the user confirms.

Update a webhook endpoint (partial). Pass enabled to enable/disable. Pass description=null to clear it. The signing secret is not returned.

Rotate a webhook endpoint's signing secret. Returns the endpoint and the NEW secret (shown only once). Only call after the user confirms.

Delete a webhook endpoint permanently. Only call after the user explicitly confirms.