tools

Create or update the server-owned access policy of a backend function (functions/<name>.js)

Create or update the server-owned access policy of a backend function (functions/<name>.js). Without a policy a function answers only to the app owner's Studio token (401 for app visitors and webhooks). Recipes: anonymous checkout step or inbound webhook/IPN -> require_auth=false; signed-in members -> require_auth=true + allowed_roles (e.g. ['authenticated'] or ['admin','staff']); webhook with a shared secret -> require_secret=true + secret_name (an app secret) that the caller sends in secret_header. allowed_hosts fences the function's outbound network to those hosts plus the platform backend; omit it for open egress.

post/api/mcp/tools/set_function_policy

Request

  • Base URL: https://finestructure.ai
  • URL: https://finestructure.ai/api/mcp/tools/set_function_policy
  • Auth: HTTP bearer

Request body

app_idstring required

The app ID

functionstring required

Function name, e.g. takbull_create (file functions/takbull_create.js)

require_authboolean required

false = anonymous visitors and external callers may invoke

allowed_rolesstring[]

App roles allowed when require_auth is true; 'authenticated' = any signed-in app member

require_secretboolean

Caller must send a shared secret header (webhooks)

secret_namestring

Name of the app secret holding the shared value (set_secret)

secret_headerstring

Header the caller sends the shared secret in

allowed_hostsstring[]

Outbound egress allow-list of host[:port] entries, e.g. ['api.takbull.co.il']. Omit to keep the stored list; pass [] to open egress again

sdk_identity'caller' | 'app'

Whose identity the SDK inside the function uses. 'caller' (default): the function reads data as whoever called it, so an anonymous call sees only what anonymous may read. 'app': the SDK acts as the app owner on THIS app's entities (a checkout or payment IPN that must load/update orders whose read policy is owner/admin/staff); the caller still counts as anonymous for rate limits, audit and X-FSe2-Caller-Type. Owner-only. Omit to keep the stored value

Response

Tool executed successfully

okboolean required
toolstring required
resultobject required

Changes

No recorded changes to this operation across all 2 revisions of this API.