Get Compose formats and identity

Outcome

Read authenticated identity and the supported document types, styles, export formats, edit modes and approval statuses. Bootstrap does not return a granted workspace identifier.

Before you start

• Verify the authenticated identity, environment and pinned organization before preparing an action.
• The published application permission is workspace:read. Discover workspace grants separately; bootstrap returns identity and enums rather than a workspace id.

Discover the target

topolo whoami --json
topolo actions get app_topolo_compose.workspace.bootstrap --detail --json

Request

GET /api/bootstrap

Save action input as payload.json. Inspect the plan for the exact path, query and body.

Inspect and test this action in the signed action console, then perform the verification below.

Input fields

Supply an empty input object; credential and resource context are separate.

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

Effects

• Returns user/organization and supported format enums after authentication.
• Does not create a document, initialize a Compose workspace mirror or enumerate workspace grants.
• The listed approvalStatuses omit rejected even though a completed rejection can be returned by document reads.

Interpret the response

Bootstrap supplies identity and enums but no workspace target identifier. Use credential-scoped workspace discovery.

Expect HTTP 200 and inspect the authenticated identity and format arrays. Discover a granted workspace separately through the platform resource/workspace catalog before reading or editing documents.

The success schema below was checked against captured handler responses. Optional structured generation metadata and integration-dependent values can vary. Error examples retain their actual refusal shapes.

Success schema:

{
  "type": "object",
  "required": [
    "user",
    "organization",
    "documentTypes",
    "stylePresets",
    "exportFormats",
    "aiEditModes",
    "approvalStatuses"
  ],
  "properties": {
    "user": {
      "type": "object",
      "required": [
        "id",
        "email",
        "orgId",
        "permissions"
      ],
      "properties": {
        "id": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "orgId": {
          "type": "string"
        },
        "permissions": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "organization": {
      "type": "object",
      "required": [
        "id",
        "slug",
        "name"
      ],
      "properties": {
        "id": {
          "type": "string"
        },
        "slug": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      }
    },
    "documentTypes": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "stylePresets": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "exportFormats": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "aiEditModes": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "approvalStatuses": {
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  }
}

Worked examples

Responses were captured from the actual Compose Worker using synthetic users, organizations, content and identifiers. Tests simulate Auth, Nexus, Notify, metering and platform workspace transport and use an in-memory D1 adapter or local SQLite. They prove local handler behavior, not live model correctness, provider cost, notification delivery, real workspace grants or cross-store atomicity. HTTP 204 responses are exactly empty strings in the SDK transport. Replace fixture identifiers through credential-scoped discovery. Refused examples demonstrate boundaries and must not be executed as successful workflows.

Successful request

Actual Compose Worker response. Auth, Nexus, notifications, metering and platform workspace transport are simulated. D1 is an in-memory adapter or local SQLite as stated by the test. This does not prove a live model completion or notification delivery. No request credentials are captured. Captured scenario: bootstrap + widget > GET /api/bootstrap returns enums.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_compose.workspace.bootstrap --data @payload.json --json
topolo actions plan app_topolo_compose.workspace.bootstrap --data @payload.json --json
topolo actions call app_topolo_compose.workspace.bootstrap --data @payload.json --json

MCP tool and arguments:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_compose.workspace.bootstrap",
    "input": {}
  }
}

Captured local response · HTTP 200:

{
  "user": {
    "id": "user_test_1",
    "email": "writer@stg.topolo.us",
    "orgId": "org_test_1",
    "permissions": [
      "*"
    ]
  },
  "organization": {
    "id": "org_test_1",
    "slug": "test-org",
    "name": "Test Org"
  },
  "documentTypes": [
    "contract",
    "scientific_paper",
    "maths_paper",
    "letterhead",
    "proposal",
    "report",
    "policy",
    "general"
  ],
  "stylePresets": [
    "executive",
    "legal",
    "academic",
    "technical",
    "brand"
  ],
  "exportFormats": [
    "docx",
    "html",
    "markdown",
    "print_pdf",
    "rtf",
    "txt"
  ],
  "aiEditModes": [
    "direct_revision",
    "suggestion_preview"
  ],
  "approvalStatuses": [
    "draft",
    "in_review",
    "approved"
  ]
}

HTTP 200. Expect HTTP 200 and inspect the authenticated identity and format arrays. Discover a granted workspace separately through the platform resource/workspace catalog before reading or editing documents.

Refused request · HTTP 503

Actual Compose Worker response. Auth, Nexus, notifications, metering and platform workspace transport are simulated. D1 is an in-memory adapter or local SQLite as stated by the test. This does not prove a live model completion or notification delivery. No request credentials are captured. Captured scenario: auth failure paths > api-key auth without configured secret is rejected.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_compose.workspace.bootstrap --data @payload.json --json
topolo actions plan app_topolo_compose.workspace.bootstrap --data @payload.json --json

Captured local response · HTTP 503:

{
  "error": "Auth service unavailable (service_token_provider)"
}

HTTP 503. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Refused request · HTTP 401

Actual Compose Worker response. Auth, Nexus, notifications, metering and platform workspace transport are simulated. D1 is an in-memory adapter or local SQLite as stated by the test. This does not prove a live model completion or notification delivery. No request credentials are captured. Captured scenario: auth failure paths > introspection failure is a 401.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_compose.workspace.bootstrap --data @payload.json --json
topolo actions plan app_topolo_compose.workspace.bootstrap --data @payload.json --json

Captured local response · HTTP 401:

{
  "error": "API key validation failed"
}

HTTP 401. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Refused request · HTTP 401

Actual Compose Worker response. Auth, Nexus, notifications, metering and platform workspace transport are simulated. D1 is an in-memory adapter or local SQLite as stated by the test. This does not prove a live model completion or notification delivery. No request credentials are captured. Captured scenario: auth failure paths > introspection without a user email is a 401.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_compose.workspace.bootstrap --data @payload.json --json
topolo actions plan app_topolo_compose.workspace.bootstrap --data @payload.json --json

Captured local response · HTTP 401:

{
  "error": "Invalid API key auth response"
}

HTTP 401. The handler refused this request. Resolve its exact cause before retrying; input validation can reject an invalid fixture before it reaches the handler.

Verify the result

• Expect HTTP 200 and inspect the authenticated identity and format arrays.
• Discover a granted workspace separately through the platform resource/workspace catalog before reading or editing documents.

Errors and recovery

• Auth service unavailable (service_token_provider) (HTTP 503): Preserve the error and request id. Inspect configured Auth, Nexus or transport health through authorized operational actions before retrying; no live provider outcome is proved by this fixture.
• API key validation failed (HTTP 401): Refresh the authorized credential in the same environment and pinned organization; do not switch scope to bypass this refusal.
• Invalid API key auth response (HTTP 401): Refresh the authorized credential in the same environment and pinned organization; do not switch scope to bypass this refusal.

Auth, action-input validation and platform resource resolution can refuse a request before its handler. Retain the exact error, request id and context; requesting another context is not a legitimate way to bypass a refusal.

Recovery boundary

No content change is made by bootstrap. Correct the credential context before proceeding if its identity is unexpected.

Related actions

• List Compose documents: List up to 200 documents created by the authenticated user in the selected authorized workspace, optionally including archived records. The read can initialize the local workspace mirror.
• Generate and save Compose document: Generate through Nexus text from a prompt and audience, then create a new Compose document and generated snapshot. Every successful call creates a new document.

Evidence

Responses were captured from the actual Compose Worker using synthetic users, organizations, content and identifiers. Tests simulate Auth, Nexus, Notify, metering and platform workspace transport and use an in-memory D1 adapter or local SQLite. They prove local handler behavior, not live model correctness, provider cost, notification delivery, real workspace grants or cross-store atomicity. HTTP 204 responses are exactly empty strings in the SDK transport. Replace fixture identifiers through credential-scoped discovery. Capture digests and test scenarios are retained in the source fixture records.