Get workspace bootstrap

Outcome

Read the verified user and organization used to bootstrap Brand.

Before you start

• Verify whoami and the pinned credential context, then inspect the exact discovered action before preparing input.
• Discover a granted Brand workspace. Pass its resourceType/workspace identifier separately from input; a copied fixture identifier grants no access.
• The declared permission is workspace:read. The active credential, application scope, resource binding and runtime authority must all authorize the request.

Discover the target

topolo whoami --json
topolo actions get app_topolo_brand.workspace.bootstrap --detail --json
topolo resources topolo-brand --json
topolo workspaces list topolo-brand --json

Request

GET /api/bootstrap

Resource context is the selected Brand workspace. CLI/SDK action input includes path identifiers; direct HTTP JSON bodies exclude path parameters. Read the reviewed plan for the exact request.

Input fields

Use {} as input; credential and workspace resource context remain separate.

Exact published input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

Effects

Reads the authenticated identity without changing Brand records.

Interpret the response

user and organization are Auth-provided identity objects. organization can be null; this response does not grant a workspace or list its kits.

Response identifier contract:

{
  "kind": "user",
  "identifierSource": "response",
  "idPath": "$.user.id"
}

Worked examples

These complete synthetic responses were captured from the local worker over canonical SQL migrations. Auth and R2 dependencies are simulated; notification delivery is not exercised. Set BRAND_WORKSPACE_ID from granted workspace discovery. Save reviewed input as payload.json, validate and inspect the unchanged plan. The final mutation command and MCP confirm flag assume the intended effect has already been authorized.

Minimal example

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_brand.workspace.bootstrap --data @payload.json --json
topolo actions plan app_topolo_brand.workspace.bootstrap --resource-type workspace --resource-id "$BRAND_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_brand.workspace.bootstrap --resource-type workspace --resource-id "$BRAND_WORKSPACE_ID" --data @payload.json --json

MCP tool and arguments:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_brand.workspace.bootstrap",
    "input": {},
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>"
  }
}

Captured local response · HTTP 200:

{
  "user": {
    "id": "usr_documentation_fixture",
    "email": "reviewer@example.invalid",
    "orgId": "org_documentation_fixture",
    "orgSlug": "documentation-fixture",
    "role": "owner",
    "permissions": [
      "*"
    ]
  },
  "organization": {
    "id": "org_documentation_fixture",
    "slug": "documentation-fixture",
    "name": "Documentation fixture"
  }
}

user and organization are Auth-provided identity objects. organization can be null; this response does not grant a workspace or list its kits.

Workflow example

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_brand.workspace.bootstrap --data @payload.json --json
topolo actions plan app_topolo_brand.workspace.bootstrap --resource-type workspace --resource-id "$BRAND_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_brand.workspace.bootstrap --resource-type workspace --resource-id "$BRAND_WORKSPACE_ID" --data @payload.json --json

MCP tool and arguments:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_brand.workspace.bootstrap",
    "input": {},
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>"
  }
}

Captured local response · HTTP 200:

{
  "user": {
    "id": "usr_documentation_fixture",
    "email": "reviewer@example.invalid",
    "orgId": "org_documentation_fixture",
    "orgSlug": "documentation-fixture",
    "role": "owner",
    "permissions": [
      "*"
    ]
  },
  "organization": {
    "id": "org_documentation_fixture",
    "slug": "documentation-fixture",
    "name": "Documentation fixture"
  }
}

user and organization are Auth-provided identity objects. organization can be null; this response does not grant a workspace or list its kits.

Verify the result

Compare the returned user and organization with whoami and discover granted Brand workspaces separately.

Errors and recovery

• auth_error (HTTP 401): CLI/SDK authentication classification when Auth returns a non-code message: restore the authorized credential, then verify whoami and context. Preserve the exact service message.

Recovery boundary

This read or validation does not change Brand service state.

Related actions

• app_topolo_brand.brand_kits.list: List Brand kits in the selected workspace.

Evidence

Four real local SQLite stores use all canonical migrations; Auth identity/grants and archival plus R2 object storage are explicitly simulated. Notifications are disabled in fixtures. No notification delivery, live mutation, gateway credential parity or deployed environment proof is claimed. Fixture identifiers and timestamps are synthetic and must be replaced by exact authorized resource discovery.