---
title: "Tenant mutation preflight (supply + optional RBAC)"
method: GET
path: "/mcp/preflight"
tags: ["MCP"]
---

# Tenant mutation preflight (supply + optional RBAC)

`GET /mcp/preflight`

## Request

- Base URL: `https://api.agentstack.tech` (the document declares no server; this is the origin it was published from)
- URL: `https://api.agentstack.tech/mcp/preflight`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

HTTP parity with MCP preflight.check — shared build_preflight_check_data spine.

## Query parameters

- `project_id` integer, required: Tenant project id
- `permission` string, nullable: Optional RBAC permission to check
- `action` string, nullable: Optional MCP action for risk/effect probe
- `action_params` string, nullable: JSON object — invoke params for FAP path probe
- `path_updates` string, nullable: JSON array — [{path, role?}] FAP probe before mutation
- `publish_asked` boolean: User already asked to publish — skips second confirm in action_risk
- `goal_text` string, nullable: Natural-language goal for effect_policy probe (parity with preflight.check)
- `semantic_contract` string, nullable: JSON fingerprinted semantic_contract (parity with preflight.check)

## Response `200`

Successful Response

- object

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict
- `422`: Validation Error
- `429`: Too Many Requests
- `500`: Internal Server Error

---

[API](https://skmtc.dev/agentstack/apis/agentstack-core-api.md) · [All operations](https://skmtc.dev/agentstack/apis/agentstack-core-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentstack/apis/agentstack-core-api/revisions/8ecf3406e74a?raw)