Overview

Moltaro Configuration API moltaro-config-v1

Public configuration and administration API for Moltaro.

Server and URL

This document may be viewed as a public reference copy on moltaro.com/docs, but moltaro.com is not a customer workspace API host.
Resolve every /api/workspace/... path against the API base URL of the configured Moltaro installation.
For actual development, prefer the OpenAPI document served by that installation at /openapi/moltaro-config-v1.json; it matches the installed release.
A human administrator first deploys or registers the workspace Web Application, creates a service user and key, and supplies the workspace API base URL. The Web Application and API URLs may differ.

Scope

This reference covers core entity definition management: definitions, schema fields, Reference Eligibility validation/impact/activation, unique constraints, indexes, configurable search targets, projection entities, display fields, object context facts, validation rules, mutation effects, direct current Entity Security configuration through Security Statements, Permission Assignments and Responsibilities, data transfer profiles, strict Entity YAML v10 portability, geo location sources, and expression validation for the Moltaro expression language (DSL).
It also covers the entity UI surface library (table, card, and form surfaces, list page, details and drawer host layouts, field UI preferences), user menus and their built-in module-page registry, Boards configuration (module lifecycle, localized board defaults, boards, statuses, transitions, Responsibilities, Security Statements, Permission Assignments, target definitions, and the board-owned data model), and Entitlement Operations configuration (module lifecycle, entitlement models, model security, plans, plan families, and renewal policies).
It also covers business-logic authoring and operations: the function catalog, function schedules, run and job operations, API function publications (commands and enqueue), HTTP endpoint function governance, managed secrets for trusted C# runtimes, entity UI action design, and the Net Operation Project source, build, and lifecycle endpoints.
Workspace file-system settings include the extension-aware declared MIME policy used by browser, API, Boards, and Package SDK uploads.
The workspace audit log is readable by administrators. It includes record archive, restore and permanent delete reasons, which remain available after a record is deleted or when its record type keeps no change history. Record rights still apply: events about an existing record the caller cannot read name it by type and ID only and omit their details (RecordDataHidden).
It also covers the Workspace UI Project: frontend source and revisions, source templates and page generators, ZIP download and upload, checks and builds, artifacts, compatibility, and the activation lifecycle. These endpoints gate on the Workspace UI Project permissions (View, Manage source, Build, Publish) in addition to role checks.
Workspace principal administration covers ordinary CRUD for users, roles, role permissions, and responsibility groups. Full role-permission replacement requires the latest aggregate RowVersion and rejects stale writers with HTTP 409; exact replay is write-free, while atomic grant/revoke endpoints are safe for additive integrations. Create accepts caller-supplied stable string ids and create/update expose bounded non-secret ExtendedData; there are no separate synchronization endpoints. User create may include an initial local Password only for a WorkspaceUser. Omit Password for deliberate passwordless provisioning and Service users. Password, invitation, external-identity, avatar, session, API-key and User-to-Worker lifecycle operations are also published with their existing authorization requirements.
Package administration, workspace settings, business-function runtime settings, Tasks configuration, Work Schedule administration and all other workspace administration controllers are included. Entitlement renewal-operation workflow endpoints and business-function invocation endpoints belong to the Runtime API.
Together with the Runtime API, this document publishes every workspace HTTP operation used by the Web Application. The C# SDK is a separate supported surface for in-project logic; it does not replace HTTP integration. Module enablement and resource permissions are enforced at execution.

Authorization

Use Authorization: Bearer <token> with a workspace access token or a service API key.
Core entity-definition operations require the Admin or Configurator role.
Audit log operations require the Admin role.
Geo Location Sources operations may also authorize resource-context managers, such as a board manager with the ManageConfiguration permission for that board.
Service accounts pass the same role and resource-context permission gates as human users.

Schema changes

Destructive schema changes (field type changes, deletions, base updates) offer schema-change-plan endpoints that preview data loss before the change is applied.

Expressions

Validation rules, field behavior conditions, presentation rules, statements, and calculated fields use the Moltaro expression language: https://moltaro.com/docs/dsl/
Calculated fields are stored values. Current calculation targets are Integer, Decimal, and Money; Display Fields are a separate read-time text contract.
Validate a field calculation without saving through POST /api/workspace/admin/entity-fields/{fieldId}/calculation/validate, then persist it with the current RowVersion through PUT /api/workspace/admin/entity-fields/{fieldId}/calculation: https://moltaro.com/docs/dsl/calculated-fields/
Validate other expressions without saving through the rule-expressions and validation-rules validation endpoints.
Request IncludeAuthoring on Entity expression-validation endpoints for the actual profile, paths, operators, functions and limits. Security profiles additionally expose authoring-options, authoring-paths and authoring-validate. Use the descriptor identity when supported and validate the exact source before saving: https://moltaro.com/docs/dsl/authoring-api/
Reference Eligibility compares Current source values with Candidate target values. Save a disabled draft or set Enabled = true to activate an impact-clean rule. Activation and active replacement recheck persisted assignments and saved surfaces inside the transaction; active rules constrain Form/Table candidates and API mutations: https://moltaro.com/docs/configuration/reference-eligibility/

Responses

Endpoints return ApiResponse<T> with Success, Data, Errors, and Warnings.

Moltaro

https://moltaro.com

Information

OpenAPI version: 3.0.4

Operations

Authentication

FileProtectionAgent

Enrolled File Protection device credential. Requires TLS; enrollment uses a one-time code.

Security scheme type: apiKey

Header parameter name: X-Moltaro-File-Protection-Agent

WorkspaceBearer

Workspace bearer token or service API key. Example: Bearer {token}

Security scheme type: http

Bearer format: Bearer