Get workspace bootstrap

Outcome

Get the verified user and organization context for this service.

Before you start

• Verify identity and the pinned organization context, then discover the exact action. This context route does not resolve a Recruit hiring workspace.
• The required application permission is workspace:read. The Worker requires a verified organization before returning the response.
• Organization identity comes from the verified credential, not an action input field.

Recruiters can perform the full hiring workflow. Hiring managers see their managed roles and candidates; interviewers see assigned interviews and their candidates. Workspace owners and organization administrators act as recruiters. Use team.me to read the caller's effective role and allowed actions.

Discover the target

topolo whoami --json
topolo actions get app_topolo_recruit.workspace.bootstrap --detail --json

Request

GET /api/bootstrap

Save input as payload.json. CLI and MCP action input includes path identifiers. The reviewed plan separates path/query fields from the HTTP body. This context route uses the verified organization and has no hiring-workspace selection.

Inspect and test this action in the signed action console. Use its discovered schema and plan; a test response still requires the verification described below.

Input fields

Use an empty JSON object as input; verified credential and workspace context are separate.

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

Effects

• Reads the verified caller context without changing state.

Interpret the response

Confirm $.user.id is the calling identity.

The response identifier path is $.organization.id for organization. Lists may be empty; an empty list is not a discovered target.

Exact success schema:

{
  "type": "object",
  "required": [
    "user"
  ],
  "properties": {
    "user": {
      "type": "object"
    },
    "organization": {
      "type": [
        "object",
        "null"
      ]
    }
  }
}

Worked examples

Actual dispatcher and migration-created SQLite or Worker handlers; Auth/workspace identity, object storage, mail and Notify dependencies are simulated. These synthetic fixtures establish no live authorization or delivery. A synthetic fixture identifier grants no access. Validate and inspect the planned request before executing. Commands with --confirm or MCP confirm:true assume the intended effect or data export has already been authorized.

Successful request

Actual Recruit Worker handler and widget builder; runtime context, identity verification and app-identity failure injection are simulated. No live credential, permission or workspace authorization is established. This complete response is a local fixture, not a deployed or delivered result.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_recruit.workspace.bootstrap --data @payload.json --json
topolo actions plan app_topolo_recruit.workspace.bootstrap --data @payload.json --json
topolo actions call app_topolo_recruit.workspace.bootstrap --data @payload.json --json

MCP tool and arguments:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_recruit.workspace.bootstrap",
    "input": {}
  }
}

Captured local response · HTTP 200:

{
  "user": {
    "id": "user_2"
  },
  "organization": {
    "id": "org_1"
  }
}

HTTP 200. Confirm $.user.id is the calling identity.

Another supported request

Actual Recruit Worker handler and widget builder; runtime context, identity verification and app-identity failure injection are simulated. No live credential, permission or workspace authorization is established. This complete response is a local fixture, not a deployed or delivered result.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_recruit.workspace.bootstrap --data @payload.json --json
topolo actions plan app_topolo_recruit.workspace.bootstrap --data @payload.json --json
topolo actions call app_topolo_recruit.workspace.bootstrap --data @payload.json --json

MCP tool and arguments:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_recruit.workspace.bootstrap",
    "input": {}
  }
}

Captured local response · HTTP 200:

{
  "user": {
    "id": "user_1"
  },
  "organization": {
    "id": "org_1"
  }
}

HTTP 200. Confirm $.user.id is the calling identity.

Refused request · organization_context_required

Actual Recruit Worker handler and widget builder; runtime context, identity verification and app-identity failure injection are simulated. No live credential, permission or workspace authorization is established. This is a refused request; diagnose it before retrying.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_recruit.workspace.bootstrap --data @payload.json --json
topolo actions plan app_topolo_recruit.workspace.bootstrap --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": "organization_context_required",
  "message": "Select an organization before using this application."
}

HTTP 403. Preserve the exact response code and details. Do not claim success.

Verify the result

• Confirm $.user.id is the calling identity.

Errors and recovery

• organization_context_required (HTTP 403): Select a verified organization before reading this service context.

Authentication or gateway failures may occur before the Recruit handler. Preserve the exact discovered service error, request id and credential context. The local fixtures do not establish live credential authorization.

Recovery boundary

This action does not change service state.

Evidence

Actual dispatcher and migration-created SQLite or Worker handlers; Auth/workspace identity, object storage, mail and Notify dependencies are simulated. These synthetic fixtures establish no live authorization or delivery. Test capture provenance is retained with each fixture. API, database and integration outcomes require separate verification in the target environment.