Outcome
Read the saved response templates available to a Support operator in one authorized workspace. Listing templates does not apply them to a ticket or send a message.
GET /api/support/macros
Before you start
Use the original authorized organization and discover an accessible canonical Support workspace. Bind the workspace separately as a resource; optional workspaceId input must agree with that binding and is not a grant.
The published action requires macros:read. The concrete route also requires actor.canReadMacros and actor.isOrganizationOperator. Source treats macros:write as macro-read capability, but ordinary organization-operator status additionally requires tickets:write, a non-guest role and an original organization id; its global-operator branch requires the recognized platform role and admin organization slug. An organization owner label or macro-read grant alone is not proof of this combined decision. Preserve a refusal instead of expanding permissions.
The selected macro query reads rows, but the shared request path can initialize local workspace scaffolding before the macro handler. Do not describe the whole call as having no writes or run it as an effect-free health probe. No actual Support call is made for this guide.
All examples are source-derived synthetic UNRUN. No actual macro, ticket, message, person, mailbox, privacy record, integration, notification, provider or key was accessed or changed. Public technical documentation does not make operator data public.
Request and behavior
Action: app_topolo_support.macros.list. Input may be {} with a separately bound workspace. Validate the current published schema before any real call.
The concrete success is HTTP200 {success:true,message:"Support macros fetched successfully",data:{macros:[...]}}. The broad collection schema permits this envelope, but the catalog resource locator $.items[].id does not identify these records. Use actual data.macros[].id from this source-qualified carrier.
After original authentication and the organization-erasure check, the shared route resolves the requested workspace against platform grants. For a verified workspace it INSERTs an identity mirror if absent, self-heals app-owned workspace-kind settings, loads active inboxes and may create/promote a default inbox. This happens before the macro-specific permission check, so a later route refusal does not prove no scaffolding effect. It does not create an Auth workspace.
For a permitted organization operator with a verified workspace, SELECT returns all matching support_macros rows scoped by workspace_id, ordered by datetime(updated_at) descending. There is no LIMIT, cursor, total, search, visibility filter or additional tie-breaker. Optional input workspaceId is not a pagination or cross-organization selector.
Each macro maps exactly id,title,body,visibility,workspaceId,suggestedStatus,suggestedPriority,createdAt,updatedAt. The mapper omits organization and creator identity. Missing strings become empty, missing visibility becomes public, and missing suggested status/priority becomes null. These defaults are mapper behavior, not a complete data-quality or validity certificate.
Macro visibility public/internal is a stored template attribute. The route is authenticated and operator-only; it returns both values without a visibility filter. public does not turn a macro into an anonymous endpoint or authorize sending its text to a customer. Reading a macro applies no ticket status, priority, action, reply or refund.
This mapper reads raw title/body rather than unprotecting them. The guide does not certify at-rest encryption, legacy ciphertext handling or safe rendering. Treat real template content as untrusted authored text within the approved operator audience.
When optional platform resolution succeeds with no workspace, the helper returns [] and the same HTTP200 envelope. Therefore empty macros can mean a successful empty workspace query or no verified workspace dimension; confirm the actual bound context before concluding that a target workspace contains no macros.
Shared authentication, workspace resolution, erasure, database and timing middleware have their own failures. An erased organization can return410 before macros. Dependency failure is not silently converted into an empty macro collection by this handler. Workspace scaffolding and the later macro query are separate, not one transaction.
Worked responses
One saved internal template
Complete source-derived synthetic UNRUN HTTP200. Original auth, non-erased organization, verified fictional workspace and combined operator/macro-read checks succeed. Exactly one matching row is present; no actual template or ticket was read.
Input:
{}
Response:
{
"success": true,
"message": "Support macros fetched successfully",
"data": {
"macros": [
{
"id": "macro_docs_fixture",
"title": "Request received",
"body": "We have received your request.",
"visibility": "internal",
"workspaceId": "ws_support_docs_fixture",
"suggestedStatus": "in_progress",
"suggestedPriority": "medium",
"createdAt": "2026-10-20T08:00:00.000Z",
"updatedAt": "2026-10-21T08:00:00.000Z"
}
]
}
}
Confirm actual data.macros[].workspaceId and retain the returned macro id only for an independently authorized task; no ticket action is applied.
An empty selected workspace
Complete synthetic UNRUN HTTP200. A verified fictional workspace exists and its successful macro query returns no rows. This example excludes the separate no-workspace case and all dependency failures.
Input:
{}
Response:
{
"success": true,
"message": "Support macros fetched successfully",
"data": {
"macros": []
}
}
Treat as no macros returned in this successful scoped query. Do not create a macro or workspace to make the result nonempty.
The macro route refuses the actor
Complete synthetic UNRUN HTTP403 from the concrete macro handler after the shared path. The actor lacks one of the combined route conditions. Shared workspace-scaffolding writes may already have happened; no actual denial was induced.
Input:
{}
Response:
{
"success": false,
"error": {
"message": "Insufficient permissions"
}
}
Retain original scope and actual refusal. The raw handler has error.message, not a stable error.code. CLI/SDK may classify the HTTP403 as permission_denied; do not invent another route code.
Verify and recover
-
Confirm the actual bound original organization and workspace, and compare each returned workspaceId. A successful empty envelope alone does not identify whether a workspace was resolved.
-
Use the exact data.macros path and all nine mapped fields. Do not infer pagination, filtered public-only content, applied ticket actions or a unique order for equal timestamps.
-
Retain the actual request id/status and sanitized failure. A read declaration is not proof of no initialization effects; do not delete workspace scaffolding, create a template, change grants/protection or send a message as recovery.
There is no macro-row mutation to undo. The shared initialization path can have separate effects; preserve uncertainty instead of deleting an inbox or mirror. The current get/create macro declarations have overlapping output alternatives and remain with the contract owner for correction; do not treat a guessed follow-up payload as a verified contract.
Change log
- 2026-10-21: Added the exact wrapped response, combined operator permission boundary, nine-field projection, unbounded ordering, visibility meaning and workspace-initialization effects, with complete synthetic examples. Source-qualified; examples remain unrun.