Configure installed-feature access
It covers installed-feature ACLs. Page visibility, site publication, channel entry/age restrictions, member moderation and manager permissions use separate workflows.
Read, plan and verify
- Call get without an installed ID. Inspect the hierarchy and select a target with
editable:true. - Read that
installedPAppIdto obtain capabilities, current permissions and the target-specific revision. Browse membership candidates using the returned pagination; never substitute profile IDs. - Prepare only the requested guest/member changes and call apply with
dryRun:true. Review both the proposed flags and preserved paid-entitlement access. - Within the authorized task, submit the same business inputs with
dryRun:false. Check status and verification; use a fresh get for the current state after completion.
Read the selected target:
{"channelCode":"selected-channel-code","installedPAppId":123}
Plan removal of guest access and individual membership links while preserving existing paid-entitlement access:
{"requestId":"access-workflow-example-001","channelCode":"selected-channel-code","installedPAppId":123,"expectedRevision":"0000000000000000000000000000000000000000000000000000000000000000","guest":"NONE","members":{"mode":"SELECTED","membershipIds":[]},"dryRun":true}
Replace the illustrative channel, ID and revision with returned values. This example does not revoke an existing paid-access entitlement. If the requested outcome cannot be expressed with the available controls, report that limit instead of inventing hidden ACL inputs.
Permission rules
| Guest mode | allowGuestAccess |
allowGuestConsume |
allowGuestPurchase |
|---|---|---|---|
NONE |
false | false | false |
INFO |
true | false | false |
CONTENT |
true | true | false |
PURCHASE |
true | true | true |
Use only the selected target's capabilities.guestModes. A00002/A00003 link information and consumption and admit NONE/CONTENT. A00005/C00005/C90105/C00014 disable consumption and admit NONE/INFO. E00003 additionally admits PURCHASE. Other editable feature codes admit NONE/INFO/CONTENT. INFO on a disabled-consumption feature follows the source UI's reachable access-off/access-on result; unsupported modes fail before saving.
| Members input | General member access | Linked memberships | Paid-entitlement access |
|---|---|---|---|
| Omitted | Preserved | Preserved | Preserved |
ALL |
Enabled | Cleared | Enabled |
SELECTED |
Disabled | Replaced with supplied IDs, sorted | Preserved |
SELECTED with [] |
Disabled | Cleared | Preserved |
EVERY_MEMBERSHIP |
Disabled | Every GENERAL membership of the channel, sorted |
Preserved |
The source dialog's paid-entitlement checkbox is disabled, so the tool exposes no independent switch to revoke that access. Get normalizes all-member grants to an empty individual-membership list. For proposed linked IDs, apply verifies the current channel's exact membership detail and type:"GENERAL"; a different type or failed read blocks the save. It also validates preserved links when they remain in the proposed ACL. Candidate pagination never implies that a partial page is complete. EVERY_MEMBERSHIP is the source dialog's "all members" off transition: it reads one membership page with the source limit of 1,000, links the GENERAL rows, and refuses (ACL_MEMBERSHIP_SET_TOO_LARGE) a channel with more than 1,000 memberships instead of truncating. The source copies every row without a type filter; system memberships keep their own system entries here. A resumed task keeps the set resolved for its plan.
Recover the original task
{"taskId":"access-workflow-example-001","taskType":"access-control"}
Use this input with status and then resume for the original authorized operation. Status checks the connection identity and reports saved phase/last result; it does not verify current channel permissions. Resume resolves the saved channel and can perform an outstanding prepared write. It is not universally read-only.
| State or result | Meaning and next action |
|---|---|
prepared |
Recheck target, original revision and membership details; the original save may still run |
| Definite rejected/not-sent save | The recorded job returns to prepared; original continuation can retry after its checks |
sending with mismatching summary |
ACCESS_OUTCOME_UNKNOWN; never resend the uncertain save |
| Matching summary but missing/different hierarchy permissions | ACCESS_VERIFICATION_MISMATCH; no success until both observations agree |
ACCESS_CONFLICT |
Revision or planned conditions changed before dispatch; read and review the current state before planning a distinct change |
ACL_SYSTEM_CONTEXT_CHANGED |
System-managed monitoring grants changed; preservation cannot be certified, and a sending task retains unknown outcome |
| Changed target/account/input | ACL_TARGET_CHANGED, CONNECTION_CHANGED or TASK_CONTEXT_CHANGED; retain the original record and resolve the context |
done |
Return stored completion; use get for a fresh observation |
The original task fingerprints its parsed inputs with dryRun:false; preserve the original expected revision, target and content on same-ID apply. Canonical ACL comparisons sort membership IDs, but this does not authorize rearranging the submitted input when recalling the same request. Completion after an uncertain response can be based on matching reads without a confirmed save receipt.
Same-task and shared-connection locks coordinate cooperating bridge processes. The upstream save has no atomic revision precondition, so a concurrent external console edit between read and write can still race. No rollback is performed.
Evidence and visitor access
verification.effectiveVisitorAccess:false means real visitor access was not tested by this workflow. Active/public state and channel entrance conditions can further restrict access even after ACL storage is confirmed. It is not a computed denial decision.
The screen contract records transport, normalization limits and historical measures. Selected nonempty membership grants, every feature/role, uncertain live failures and actual guest/member/paid-visitor sessions remain separate cases.
Saved record identity
For this workflow, existing apply/dry-run calls and task status/resume require
both the saved task ID and saved input requestId to match the requested ID.
A mismatching or malformed saved identity returns TASK_STATE_UNVERIFIED before
workflow context or business-state reads. Preserve the original record for
inspection; do not rename/edit it, try its embedded ID or create a replacement
request to bypass the error. No stored record is repaired or resent. Valid
matching records retain the recovery behavior described above.