Overview

Moltaro Configuration API moltaro-config-v1

Curated configuration API for Moltaro.

Server and URL

This document may be viewed as a public reference copy on moltaro.com/docs, but moltaro.com is not a customer workspace API host.
Resolve every /api/workspace/... path against the API base URL of the configured Moltaro installation.
For actual development, prefer the OpenAPI document served by that installation at /openapi/moltaro-config-v1.json; it matches the installed release.
A human administrator first deploys or registers the workspace Web Application, creates a service user and key, and supplies the workspace API base URL. The Web Application and API URLs may differ.

Scope

This reference covers core entity definition management: definitions, schema fields, Reference Eligibility validation/impact/disabled metadata, unique constraints, indexes, configurable search targets, projection entities, display fields, object context facts, validation rules, mutation effects, direct current Entity Security configuration through Security Statements, Permission Assignments and Responsibilities, data transfer profiles, strict Entity YAML v8 portability, geo location sources, and expression validation for the Moltaro expression language (DSL).
It also covers the entity UI surface library (table, card, and form surfaces, list page, details and drawer host layouts, field UI preferences), user menus and their built-in module-page registry, Boards configuration (module lifecycle, localized board defaults, boards, statuses, transitions, Responsibilities, Security Statements, Permission Assignments, target definitions, and the board-owned data model), and Entitlement Operations configuration (module lifecycle, entitlement models, model security, plans, plan families, and renewal policies).
It also covers business-logic authoring and operations: the function catalog, function schedules, run and job operations, API function publications (commands and enqueue), HTTP endpoint function governance, managed secrets for trusted C# runtimes, entity UI action design, and the Net Operation Project source, build, and lifecycle endpoints.
Workspace file-system settings include the extension-aware declared MIME policy used by browser, API, Boards, and Package SDK uploads.
It also covers the Workspace UI Project: frontend source and revisions, source templates and page generators, ZIP download and upload, checks and builds, artifacts, compatibility, and the activation lifecycle. These endpoints gate on the Workspace UI Project permissions (View, Manage source, Build, Publish) in addition to role checks.
Workspace principal administration covers ordinary CRUD for users, roles, role permissions, and responsibility groups. Create accepts caller-supplied stable string ids and create/update expose bounded non-secret ExtendedData; there are no separate synchronization endpoints. User create may include an initial local Password only for a WorkspaceUser. Omit Password for deliberate passwordless provisioning and Service users. Subsequent password, invitation, external-identity, avatar, token, and API-key lifecycle endpoints are intentionally excluded.
Other administration areas (packages, general workspace settings, and business-function runtime settings) are intentionally excluded from this version. Entitlement renewal-operation workflow endpoints and business-function invocation endpoints belong to the Runtime API.

Authorization

Use Authorization: Bearer <token> with a workspace access token or a service API key.
Core entity-definition operations require the Admin or Configurator role.
Geo Location Sources operations may also authorize resource-context managers, such as a board manager with the ManageConfiguration permission for that board.
Service accounts pass the same role and resource-context permission gates as human users.

Schema changes

Destructive schema changes (field type changes, deletions, base updates) offer schema-change-plan endpoints that preview data loss before the change is applied.

Expressions

Validation rules, field behavior conditions, presentation rules, statements, and calculated fields use the Moltaro expression language: https://moltaro.com/docs/dsl/
Calculated fields are stored values. Current calculation targets are Integer, Decimal, and Money; Display Fields are a separate read-time text contract.
Validate a field calculation without saving through POST /api/workspace/admin/entity-fields/{fieldId}/calculation/validate, then persist it with the current RowVersion through PUT /api/workspace/admin/entity-fields/{fieldId}/calculation: https://moltaro.com/docs/dsl/calculated-fields/
Validate other expressions without saving through the rule-expressions and validation-rules validation endpoints.
Reference Eligibility compares Current source values with Candidate target values. This API currently validates, impact-checks, and stores disabled rules; Enabled = true remains unavailable until runtime candidate and mutation consumers are released: https://moltaro.com/docs/configuration/reference-eligibility/

Responses

Endpoints return ApiResponse<T> with Success, Data, Errors, and Warnings.

Moltaro

https://moltaro.com

Information

OpenAPI version: 3.0.4

Operations

Authentication

WorkspaceBearer

Workspace bearer token or service API key. Example: Bearer {token}

Security scheme type: http

Bearer format: Bearer