picked 0.0.101 → 0.0.102-next.2

package/docs/reference/management-api/schema/index.md

@@ -21,190 +21,190 @@ An operation with `@auth` needs a caller that has authenticated. `@auth(only: US
 
 | Operation | Type | Description |
 | --- | --- | --- |
-| [`accountCreate`](/reference/management-api/schema/auth#accountcreate) | Mutation | Register an email address and send it a confirmation email. |
-| [`accountResendVerification`](/reference/management-api/schema/auth#accountresendverification) | Mutation | Resend the email verification link. |
-| [`accountVerifyEmail`](/reference/management-api/schema/auth#accountverifyemail) | Mutation | Verify a user's email address with a confirmation token. |
-| [`action`](/reference/management-api/schema/action#action) | Query | Get an action by ID within a workspace. |
-| [`actionCreate`](/reference/management-api/schema/action#actioncreate) | Mutation | Create a new action. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`actionDelete`](/reference/management-api/schema/action#actiondelete) | Mutation | Delete an action. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`actions`](/reference/management-api/schema/action#actions) | Query | List actions in a workspace. Filter by name with `search` (case-insensitive substring) and order with `sortKey` (default `NAME`) plus `reverse`. |
-| [`actionUpdate`](/reference/management-api/schema/action#actionupdate) | Mutation | Update an action. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`apiKeyCreate`](/reference/management-api/schema/api-key#apikeycreate) | Mutation | Create a new API key. Requires scope: `ORGANIZATION_API_KEYS_CREATE`. User authentication only (not API key). |
-| [`apiKeyRevoke`](/reference/management-api/schema/api-key#apikeyrevoke) | Mutation | Revoke an API key. Requires scope: `ORGANIZATION_API_KEYS_DELETE`. |
-| [`apiKeys`](/reference/management-api/schema/api-key#apikeys) | Query | List API keys for an organisation. Requires authentication. |
-| [`asset`](/reference/management-api/schema/cms-models#asset) | Query | Fetch a CMS Asset by id. |
-| [`assetCommit`](/reference/management-api/schema/cms-models#assetcommit) | Mutation | Finalise an Asset upload — captures size, MIME, and intrinsic dimensions for images. |
-| [`assetDelete`](/reference/management-api/schema/cms-models#assetdelete) | Mutation | Soft-delete an Asset. The underlying storage object is removed best-effort. |
-| [`assets`](/reference/management-api/schema/cms-models#assets) | Query | List CMS Assets in a project, with optional text search, MIME-type filtering, and sort. |
-| [`assetUploadInit`](/reference/management-api/schema/cms-models#assetuploadinit) | Mutation | Initiate an Asset upload — returns a pre-signed PUT URL plus the allocated asset id. |
-| [`condition`](/reference/management-api/schema/condition#condition) | Query | Get a condition by ID within a workspace. |
-| [`conditionCreate`](/reference/management-api/schema/condition#conditioncreate) | Mutation | Create a new condition. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`conditionDelete`](/reference/management-api/schema/condition#conditiondelete) | Mutation | Delete a condition. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`conditions`](/reference/management-api/schema/condition#conditions) | Query | List conditions in a workspace. Filter by name with `search` (case-insensitive substring) and order with `sortKey` (default `NAME`) plus `reverse`. |
-| [`conditionUpdate`](/reference/management-api/schema/condition#conditionupdate) | Mutation | Update a condition. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`contentBlock`](/reference/management-api/schema/cms-models#contentblock) | Query | Fetch a CMS Content Block by id. |
-| [`contentBlockCreate`](/reference/management-api/schema/cms-models#contentblockcreate) | Mutation | Create a new CMS Content Block. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`contentBlockDelete`](/reference/management-api/schema/cms-models#contentblockdelete) | Mutation | Soft-delete a CMS Content Block. |
-| [`contentBlocks`](/reference/management-api/schema/cms-models#contentblocks) | Query | List CMS Content Blocks in a workspace, optionally filtered by category. |
-| [`contentBlockUpdate`](/reference/management-api/schema/cms-models#contentblockupdate) | Mutation | Update a CMS Content Block schema. |
-| [`contentEntries`](/reference/management-api/schema/cms-models#contententries) | Query | List CMS Content Entries in a workspace, optionally filtered by parent Content Model. |
-| [`contentEntry`](/reference/management-api/schema/cms-models#contententry) | Query | Fetch a CMS Content Entry by id. |
-| [`contentEntryCreate`](/reference/management-api/schema/cms-models#contententrycreate) | Mutation | Create a new CMS Content Entry against a parent Content Model. |
-| [`contentEntryDelete`](/reference/management-api/schema/cms-models#contententrydelete) | Mutation | Soft-delete a CMS Content Entry. Refuses if a Step references it. |
-| [`contentEntryUpdate`](/reference/management-api/schema/cms-models#contententryupdate) | Mutation | Update a CMS Content Entry's data. |
-| [`contentModel`](/reference/management-api/schema/cms-models#contentmodel) | Query | Fetch a CMS Content Model by id. |
-| [`contentModelCreate`](/reference/management-api/schema/cms-models#contentmodelcreate) | Mutation | Create a new CMS Content Model. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`contentModelDelete`](/reference/management-api/schema/cms-models#contentmodeldelete) | Mutation | Soft-delete a CMS Content Model. Refuses if dependent Content Entry rows still exist. |
-| [`contentModels`](/reference/management-api/schema/cms-models#contentmodels) | Query | List CMS Content Models in a workspace, optionally filtered by category. |
-| [`contentModelUpdate`](/reference/management-api/schema/cms-models#contentmodelupdate) | Mutation | Update a CMS Content Model. Returns migration warnings when the schema change drops or coerces dependent Content Entry fields. |
-| [`createShopifyMetafieldConfig`](/reference/management-api/schema/shopify#createshopifymetafieldconfig) | Mutation |  |
-| [`createShopifyWebhook`](/reference/management-api/schema/shopify#createshopifywebhook) | Mutation |  |
-| [`deleteShopifyMetafieldConfig`](/reference/management-api/schema/shopify#deleteshopifymetafieldconfig) | Mutation |  |
-| [`deleteShopifyWebhook`](/reference/management-api/schema/shopify#deleteshopifywebhook) | Mutation |  |
-| [`designSystem`](/reference/management-api/schema/design-system#designsystem) | Query | Get a design system by ID. |
-| [`designSystemCreate`](/reference/management-api/schema/design-system#designsystemcreate) | Mutation | Create a new design system. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`designSystemDelete`](/reference/management-api/schema/design-system#designsystemdelete) | Mutation | Delete a design system. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`designSystems`](/reference/management-api/schema/design-system#designsystems) | Query | List design systems in a project. Filter by name with `search` (case-insensitive substring) and order with `sortKey` (default `NAME`) plus `reverse`. |
-| [`designSystemUpdate`](/reference/management-api/schema/design-system#designsystemupdate) | Mutation | Update a design system. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`emailLinkVerify`](/reference/management-api/schema/auth#emaillinkverify) | Mutation | Verify the link from a password-reset, invitation, sign-in or confirmation email and create a session. The link is single-use, so call this when the recipient confirms, never on opening the link: an email security scanner that opens links before delivery would otherwise use it up. |
-| [`experience`](/reference/management-api/schema/experience#experience) | Query | Get an experience by ID within a workspace. |
-| [`experienceCreate`](/reference/management-api/schema/experience#experiencecreate) | Mutation | Create a new experience. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`experienceDelete`](/reference/management-api/schema/experience#experiencedelete) | Mutation | Delete an experience. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`experienceFlowUpdate`](/reference/management-api/schema/experience#experienceflowupdate) | Mutation | Atomically save all changes to an experience flow. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`experiences`](/reference/management-api/schema/experience#experiences) | Query | List experiences within a workspace. Filter by name with `search` (case-insensitive substring) and order with `sortKey` (default `NAME`) plus `reverse`. |
-| [`experienceUpdate`](/reference/management-api/schema/experience#experienceupdate) | Mutation | Update an experience. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`externalApi`](/reference/management-api/schema/external-api#externalapi) | Query | Fetch a single external API by ID, or null if it does not exist. Requires authentication and `ORGANIZATION_INTEGRATIONS_READ` on its project. |
-| [`externalApiAuthHeaderClear`](/reference/management-api/schema/external-api#externalapiauthheaderclear) | Mutation | Remove the static auth header from an external API. Idempotent. Requires a user context and `ORGANIZATION_INTEGRATIONS_UPDATE`; API keys are rejected. |
-| [`externalApiAuthHeaderSet`](/reference/management-api/schema/external-api#externalapiauthheaderset) | Mutation | Set or replace the single static auth header on an external API, removing an OAuth2 credential it holds. Requires a user context and `ORGANIZATION_INTEGRATIONS_UPDATE`; API keys are rejected. |
-| [`externalApiCreate`](/reference/management-api/schema/external-api#externalapicreate) | Mutation | Register an external API to a project. Requires a user context and `ORGANIZATION_INTEGRATIONS_CREATE`; API keys are rejected. |
-| [`externalApiDelete`](/reference/management-api/schema/external-api#externalapidelete) | Mutation | Delete an external API registration and its encrypted credentials. Idempotent. Requires a user context and `ORGANIZATION_INTEGRATIONS_DELETE`; API keys are rejected. |
-| [`externalApiOAuth2Clear`](/reference/management-api/schema/external-api#externalapioauth2clear) | Mutation | Remove the OAuth2 credential, its secrets and its cached access token from an external API. Idempotent. Requires a user context and `ORGANIZATION_INTEGRATIONS_UPDATE`; API keys are rejected. |
-| [`externalApiOAuth2Set`](/reference/management-api/schema/external-api#externalapioauth2set) | Mutation | Set or replace the OAuth2 credential on an external API, removing a static auth header it holds. Requires a user context and `ORGANIZATION_INTEGRATIONS_UPDATE`; API keys are rejected. |
-| [`externalApiUpdate`](/reference/management-api/schema/external-api#externalapiupdate) | Mutation | Rename an external API. Requires a user context and `ORGANIZATION_INTEGRATIONS_UPDATE`; API keys are rejected. |
-| [`feature`](/reference/management-api/schema/feature#feature) | Query | Fetch a single feature by ID and workspace ID. Requires authentication. |
-| [`featureCreate`](/reference/management-api/schema/feature#featurecreate) | Mutation | Create a new feature. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`featureDelete`](/reference/management-api/schema/feature#featuredelete) | Mutation | Delete a feature. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`features`](/reference/management-api/schema/feature#features) | Query | List features in a workspace. Filter by name with `search` (case-insensitive substring) and order with `sortKey` (default `NAME`) plus `reverse`. |
-| [`featureUpdate`](/reference/management-api/schema/feature#featureupdate) | Mutation | Update a feature. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`feedbackCreate`](/reference/management-api/schema/feedback#feedbackcreate) | Mutation | Submit user feedback from the dashboard. Requires authentication (USER token only). |
-| [`field`](/reference/management-api/schema/field#field) | Query | Get a field by ID within a workspace. |
-| [`fieldCreate`](/reference/management-api/schema/field#fieldcreate) | Mutation | Create a new field. Requires scope: `ORGANIZATION_PROJECTS_CREATE`. |
-| [`fieldDelete`](/reference/management-api/schema/field#fielddelete) | Mutation | Delete a field. Requires scope: `ORGANIZATION_PROJECTS_DELETE`. |
-| [`fields`](/reference/management-api/schema/field#fields) | Query | Get list of fields within a workspace. |
-| [`fieldUpdate`](/reference/management-api/schema/field#fieldupdate) | Mutation | Update a field. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`integrationConfigurationCreate`](/reference/management-api/schema/integration#integrationconfigurationcreate) | Mutation | Create a configuration for an installed integration. Requires scope: `ORGANIZATION_INTEGRATIONS_CREATE`. |
-| [`integrationConfigurationDelete`](/reference/management-api/schema/integration#integrationconfigurationdelete) | Mutation | Delete an integration's configuration. Requires scope: `ORGANIZATION_INTEGRATIONS_DELETE`. |
-| [`integrationConfigurationUpdate`](/reference/management-api/schema/integration#integrationconfigurationupdate) | Mutation | Update an integration's configuration. Requires scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
-| [`integrationInstall`](/reference/management-api/schema/integration#integrationinstall) | Mutation | Install an integration for a project. Requires scope: `ORGANIZATION_INTEGRATIONS_CREATE`. |
-| [`integrationUninstall`](/reference/management-api/schema/integration#integrationuninstall) | Mutation | Uninstall an integration (cascades to delete all configurations). Requires scope: `ORGANIZATION_INTEGRATIONS_DELETE`. |
-| [`labelsDelete`](/reference/management-api/schema/label#labelsdelete) | Mutation | Remove labels from an owner. Requires scope: `ORGANIZATION_LEADS_UPDATE` on the lead's project for a `LEAD` owner, and `ORGANIZATION_PROJECTS_UPDATE` on the project for a `PROJECT` or `WORKFLOW_RUN` owner. |
-| [`labelsSet`](/reference/management-api/schema/label#labelsset) | Mutation | Create or replace labels on an owner. Requires scope: `ORGANIZATION_LEADS_UPDATE` on the lead's project for a `LEAD` owner, and `ORGANIZATION_PROJECTS_UPDATE` on the project for a `PROJECT` or `WORKFLOW_RUN` owner. |
-| [`lead`](/reference/management-api/schema/lead#lead) | Query | Get a lead by ID. Requires scope: `ORGANIZATION_LEADS_READ`. |
-| [`leadDelete`](/reference/management-api/schema/lead#leaddelete) | Mutation | Permanently delete a lead and its labels. Requires scope: `ORGANIZATION_LEADS_DELETE`. |
-| [`magicLinkSend`](/reference/management-api/schema/auth#magiclinksend) | Mutation | Email an existing account a sign-in code and link. Never creates an account, and answers `success: true` for an address with no account. |
-| [`magicLinkVerify`](/reference/management-api/schema/auth#magiclinkverify) | Mutation | Verify the code from a sign-in or confirmation email and create a session. |
-| [`mcpServer`](/reference/management-api/schema/mcp-server#mcpserver) | Query | Fetch a single registered MCP server by ID, or null if it doesn't exist. Requires authentication. |
-| [`mcpServerAuthHeaderClear`](/reference/management-api/schema/mcp-server#mcpserverauthheaderclear) | Mutation | Remove the auth header from an MCP server. Idempotent. Requires a user context; API keys are rejected. |
-| [`mcpServerAuthHeaderSet`](/reference/management-api/schema/mcp-server#mcpserverauthheaderset) | Mutation | Set or replace the single auth header on an MCP server. Requires a user context; API keys are rejected. |
-| [`mcpServerDelete`](/reference/management-api/schema/mcp-server#mcpserverdelete) | Mutation | Delete an MCP server registration and any encrypted credentials. Idempotent. |
-| [`mcpServerRegister`](/reference/management-api/schema/mcp-server#mcpserverregister) | Mutation | Register a new third-party MCP server. Requires a user context; API keys are rejected. |
-| [`mcpServerUpdate`](/reference/management-api/schema/mcp-server#mcpserverupdate) | Mutation | Update an MCP server's display name. URL rotation goes through `mcpServerUrlSet`. Requires a user context; API keys are rejected. |
-| [`mcpServerUrlSet`](/reference/management-api/schema/mcp-server#mcpserverurlset) | Mutation | Rotate the MCP server's URL. The new URL is encrypted; the response surfaces only the display URL. Requires a user context; API keys are rejected. |
-| [`mfaChallengeCreate`](/reference/management-api/schema/auth#mfachallengecreate) | Mutation | Open a challenge against one of the caller's factors. Requires a user session; exempt from the MFA policy. |
-| [`mfaChallengeVerify`](/reference/management-api/schema/auth#mfachallengeverify) | Mutation | Verify a code against a challenge and lift the caller's session to `AAL2`. Requires a user session; exempt from the MFA policy. |
-| [`mfaFactorEnroll`](/reference/management-api/schema/auth#mfafactorenroll) | Mutation | Enrol an authenticator app for the caller. Requires a user session; exempt from the MFA policy. |
-| [`mfaFactorUnenroll`](/reference/management-api/schema/auth#mfafactorunenroll) | Mutation | Remove one of the caller's factors. Requires a user session; exempt from the MFA policy, though removing a verified factor needs `AAL2`. |
-| [`oauthAuthorize`](/reference/management-api/schema/auth#oauthauthorize) | Mutation | Initiate an OAuth authorisation flow. |
-| [`oauthCallback`](/reference/management-api/schema/auth#oauthcallback) | Mutation | Handle the OAuth callback and create a session. |
-| [`oauthConsentApprove`](/reference/management-api/schema/auth#oauthconsentapprove) | Mutation | Approve an OAuth consent request. Requires authentication. |
-| [`oauthConsentDeny`](/reference/management-api/schema/auth#oauthconsentdeny) | Mutation | Deny an OAuth consent request. Requires authentication. |
-| [`oauthConsentDetails`](/reference/management-api/schema/auth#oauthconsentdetails) | Query | Get OAuth consent authorisation details. Requires authentication (USER token only). |
-| [`organization`](/reference/management-api/schema/organization#organization) | Query | Fetch a single organisation by ID or slug. Requires authentication. |
-| [`organizationClientManagerScopesUpdate`](/reference/management-api/schema/organization#organizationclientmanagerscopesupdate) | Mutation | Set the scopes a client manager holds in one organisation. Requires `STAFF_INVITE_CLIENT_MANAGER` at root. The target must be a client manager, and a caller may not edit their own scopes. A client manager may add or remove only scopes their own client-manager grant in that organisation carries; a super admin may set any. |
-| [`organizationCreate`](/reference/management-api/schema/organization#organizationcreate) | Mutation | Create a new organisation. Requires scope: `ORGANIZATION_CREATE`. |
-| [`organizationDelete`](/reference/management-api/schema/organization#organizationdelete) | Mutation | Delete an organisation. Requires scope: `ORGANIZATION_DELETE`. |
-| [`organizationInvitationAccept`](/reference/management-api/schema/organization#organizationinvitationaccept) | Mutation | Accept an organisation invitation. Requires authentication. |
-| [`organizationInvitationDecline`](/reference/management-api/schema/organization#organizationinvitationdecline) | Mutation | Decline an organisation invitation. Requires authentication. |
-| [`organizationInvitationRevoke`](/reference/management-api/schema/organization#organizationinvitationrevoke) | Mutation | Revoke an organisation invitation. Requires scope: `ORGANIZATION_INVITATIONS_DELETE`. |
-| [`organizationMemberInvite`](/reference/management-api/schema/organization#organizationmemberinvite) | Mutation | Invite a member to an organisation. Requires scope: `ORGANIZATION_INVITATIONS_CREATE`. |
-| [`organizationMemberRemove`](/reference/management-api/schema/organization#organizationmemberremove) | Mutation | Remove a member from an organisation. Requires scope: `ORGANIZATION_MEMBERS_DELETE`. |
-| [`organizationMemberScopesUpdate`](/reference/management-api/schema/organization#organizationmemberscopesupdate) | Mutation | Set the scopes a member holds in an organisation. Requires `ORGANIZATION_MEMBERS_MANAGE_SCOPES` reaching that organisation. The target must be a member. A caller may not grant a scope they do not themselves hold, and may not edit their own scopes. |
-| [`organizations`](/reference/management-api/schema/organization#organizations) | Query | List organisations the authenticated user belongs to. Requires authentication. |
-| [`organizationShopifyWebhooks`](/reference/management-api/schema/shopify#organizationshopifywebhooks) | Query |  |
-| [`organizationUpdate`](/reference/management-api/schema/organization#organizationupdate) | Mutation | Update an organisation. Requires scope: `ORGANIZATION_UPDATE`. |
-| [`passwordResetSend`](/reference/management-api/schema/auth#passwordresetsend) | Mutation | Send a password reset email. |
-| [`passwordUpdate`](/reference/management-api/schema/auth#passwordupdate) | Mutation | Update the current user's password. Requires authentication. An `AAL1` session may set a password only while the user holds no verified factor, and is otherwise refused with `MFA_REQUIRED`. |
-| [`pickedqlQuery`](/reference/management-api/schema/analytics#pickedqlquery) | Query | Execute a PickedQL query scoped to the caller's authorised projects. |
-| [`ping`](/reference/management-api/schema/common#ping) | Query | Liveness probe used by infrastructure to confirm the GraphQL endpoint is up. Unauthenticated. |
-| [`project`](/reference/management-api/schema/project#project) | Query | Fetch a single project by ID. Requires authentication. |
-| [`projectCreate`](/reference/management-api/schema/project#projectcreate) | Mutation | Create a new project. Requires scope: `ORGANIZATION_PROJECTS_CREATE`. |
-| [`projectDelete`](/reference/management-api/schema/project#projectdelete) | Mutation | Delete a project. Requires scope: `ORGANIZATION_PROJECTS_DELETE`. |
-| [`projectPreviewEnvironmentCreate`](/reference/management-api/schema/project#projectpreviewenvironmentcreate) | Mutation | Create a project preview environment. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`projectPreviewEnvironmentDelete`](/reference/management-api/schema/project#projectpreviewenvironmentdelete) | Mutation | Delete a project preview environment. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`projectPreviewEnvironmentUpdate`](/reference/management-api/schema/project#projectpreviewenvironmentupdate) | Mutation | Update a project preview environment. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`projects`](/reference/management-api/schema/project#projects) | Query | List projects the authenticated user can reach, across every organisation they belong to. Pass `organizationId` to narrow the list to one organisation, and `search` to match project names case-insensitively. Requires authentication. |
-| [`projectShopifyMetafieldConfigs`](/reference/management-api/schema/shopify#projectshopifymetafieldconfigs) | Query |  |
-| [`projectUpdate`](/reference/management-api/schema/project#projectupdate) | Mutation | Update a project. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`report`](/reference/management-api/schema/report#report) | Query | Fetch a single report by id. Requires authentication. |
-| [`reportCreate`](/reference/management-api/schema/report#reportcreate) | Mutation | Create a new report. Requires scope: `ORGANIZATION_REPORTS_CREATE`. |
-| [`reportDelete`](/reference/management-api/schema/report#reportdelete) | Mutation | Delete a report. Requires scope: `ORGANIZATION_REPORTS_DELETE`. |
-| [`reportUpdate`](/reference/management-api/schema/report#reportupdate) | Mutation | Update a report. Requires scope: `ORGANIZATION_REPORTS_UPDATE`. |
-| [`savedView`](/reference/management-api/schema/saved-view#savedview) | Query | Get a saved view by ID. Requires scope: `ORGANIZATION_PROJECTS_READ`. |
-| [`savedViewCreate`](/reference/management-api/schema/saved-view#savedviewcreate) | Mutation | Save a view of a project's list. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`savedViewDelete`](/reference/management-api/schema/saved-view#savedviewdelete) | Mutation | Delete a saved view. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`savedViewUpdate`](/reference/management-api/schema/saved-view#savedviewupdate) | Mutation | Rename a saved view, change what it restores, or move the default. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`sessionCreate`](/reference/management-api/schema/auth#sessioncreate) | Mutation | Create a new session by signing in with email and password. |
-| [`sessionRefresh`](/reference/management-api/schema/auth#sessionrefresh) | Mutation | Refresh an existing session using a refresh token. |
-| [`sessionStart`](/reference/management-api/schema/auth#sessionstart) | Mutation | Begin signing in with an email address alone. Answers `PASSWORD` when the account has set a password, and otherwise emails a sign-in code and link and answers `EMAIL_CODE`. Never creates an account. Returns `RATE_LIMITED` when the caller makes too many requests, or when the project's email quota is spent. |
-| [`shopifyCollectionContentUpdate`](/reference/management-api/schema/shopify#shopifycollectioncontentupdate) | Mutation | Update Shopify collection content. Requires authentication. |
-| [`shopifyMetafieldConfigCreate`](/reference/management-api/schema/shopify#shopifymetafieldconfigcreate) | Mutation | Create a Shopify metafield config. Requires authentication. |
-| [`shopifyMetafieldConfigDelete`](/reference/management-api/schema/shopify#shopifymetafieldconfigdelete) | Mutation | Delete a Shopify metafield config. Requires authentication. |
-| [`shopifyMetafieldConfigs`](/reference/management-api/schema/shopify#shopifymetafieldconfigs) | Query | List Shopify metafield configs for a project. Requires authentication. |
-| [`shopifyMetafieldConfigUpdate`](/reference/management-api/schema/shopify#shopifymetafieldconfigupdate) | Mutation | Update a Shopify metafield config. Requires authentication. |
-| [`shopifyProduct`](/reference/management-api/schema/shopify#shopifyproduct) | Query |  |
-| [`shopifyProductContentUpdate`](/reference/management-api/schema/shopify#shopifyproductcontentupdate) | Mutation | Update Shopify product content. Requires authentication. |
-| [`shopifyProducts`](/reference/management-api/schema/shopify#shopifyproducts) | Query |  |
-| [`shopifyWebhookCreate`](/reference/management-api/schema/shopify#shopifywebhookcreate) | Mutation | Create a new Shopify webhook. Requires authentication. |
-| [`shopifyWebhookDelete`](/reference/management-api/schema/shopify#shopifywebhookdelete) | Mutation | Delete a Shopify webhook. Requires authentication. |
-| [`shopifyWebhooks`](/reference/management-api/schema/shopify#shopifywebhooks) | Query | List Shopify webhooks for an organisation. Requires authentication. |
-| [`shopifyWebhookUpdate`](/reference/management-api/schema/shopify#shopifywebhookupdate) | Mutation | Update a Shopify webhook. Requires authentication. |
-| [`step`](/reference/management-api/schema/step#step) | Query | Get a step by ID within a workspace. |
-| [`stepCreate`](/reference/management-api/schema/step#stepcreate) | Mutation | Create a new step. Requires scope: `ORGANIZATION_PROJECTS_CREATE`. |
-| [`stepDelete`](/reference/management-api/schema/step#stepdelete) | Mutation | Delete a step. Requires scope: `ORGANIZATION_PROJECTS_DELETE`. |
-| [`steps`](/reference/management-api/schema/step#steps) | Query | Get list of steps within a workspace. |
-| [`stepUpdate`](/reference/management-api/schema/step#stepupdate) | Mutation | Update a step. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`tenant`](/reference/management-api/schema/tenant-branding#tenant) | Query | Resolve a tenant (and its branding) by host or explicit slug. Unauthenticated; cached for 5 minutes. |
-| [`updateShopifyCollectionContent`](/reference/management-api/schema/shopify#updateshopifycollectioncontent) | Mutation |  |
-| [`updateShopifyMetafieldConfig`](/reference/management-api/schema/shopify#updateshopifymetafieldconfig) | Mutation |  |
-| [`updateShopifyProductContent`](/reference/management-api/schema/shopify#updateshopifyproductcontent) | Mutation |  |
-| [`updateShopifyWebhook`](/reference/management-api/schema/shopify#updateshopifywebhook) | Mutation |  |
-| [`user`](/reference/management-api/schema/auth#user) | Query | Fetch the currently authenticated user. Returns null if the request is unauthenticated. Exempt from the MFA policy, so a gated user can read `mfa` and `mfaFactors`. |
-| [`viewerScopes`](/reference/management-api/schema/auth#viewerscopes) | Query | Root-level scopes for the authenticated user (e.g. `ORGANIZATION_CREATE`, `STAFF_READ`). Use `Organization.viewerScopes` for org-scoped scopes. |
-| [`workbenchAssetAdoptOwned`](/reference/management-api/schema/workbench#workbenchassetadoptowned) | Mutation | Adopts an existing project-library Asset as `OWNED` by a Workbench, transferring the Asset's ownership. Used when a Create-Page upload is bound to its Workbench after the Workbench is created. |
-| [`workbenchAssetImport`](/reference/management-api/schema/workbench#workbenchassetimport) | Mutation | Imports an Asset owned elsewhere into a Workbench, creating an `IMPORTED` membership. Removing the import (`workbenchAssetRemove`) drops only the join, never the Asset. |
-| [`workbenchAssetRemove`](/reference/management-api/schema/workbench#workbenchassetremove) | Mutation | Removes an Asset's membership from a Workbench. If the membership was `OWNED`, the Asset is also soft-deleted; if `IMPORTED`, only the join is dropped. |
-| [`workflow`](/reference/management-api/schema/workflow#workflow) | Query | Get a workflow by ID. |
-| [`workflowCreate`](/reference/management-api/schema/workflow#workflowcreate) | Mutation | Create a new workflow. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workflowDelete`](/reference/management-api/schema/workflow#workflowdelete) | Mutation | Delete a workflow. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workflowGraphUpdate`](/reference/management-api/schema/workflow#workflowgraphupdate) | Mutation | Apply a batch of changes to a workflow's graph, all or nothing. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workflowRun`](/reference/management-api/schema/workflow-run#workflowrun) | Query | Get a workflow run by ID. Requires scope: `ORGANIZATION_PROJECTS_READ`. |
-| [`workflows`](/reference/management-api/schema/workflow#workflows) | Query | List workflows in a workspace. Filter by name with `search` (case-insensitive substring) and order with `sortKey` (default `NAME`) plus `reverse`. |
-| [`workflowTestRun`](/reference/management-api/schema/workflow#workflowtestrun) | Mutation | Walk a workflow's draft graph once against a supplied trigger input, holding every write back, and return what each node did. Nothing is stored. Requires scope `ORGANIZATION_WORKSPACE_UPDATE` and every scope in `Workflow.scopes`; a refusal names each one missing. |
-| [`workflowTools`](/reference/management-api/schema/workflow#workflowtools) | Query | Every tool a workflow node may run, with the arguments each accepts. Read by the editor to build its node palette. |
-| [`workflowUpdate`](/reference/management-api/schema/workflow#workflowupdate) | Mutation | Update a workflow. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workspace`](/reference/management-api/schema/workspace#workspace) | Query | Get a specific workspace. Requires authentication. |
-| [`workspaceArchive`](/reference/management-api/schema/workspace#workspacearchive) | Mutation | Archive a non-live workspace. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workspaceContentEntryValidation`](/reference/management-api/schema/cms-models#workspacecontententryvalidation) | Query | Run schema validation across every Content Entry in a workspace and report which rows no longer conform. Read-only — does not auto-fix. Useful as a pre-publish sanity gate, especially after a Content Block schema change. Optionally narrow the sweep to a single Content Model with `contentModelId`. |
-| [`workspaceCreate`](/reference/management-api/schema/workspace#workspacecreate) | Mutation | Create a new workspace on a project. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workspaceDelete`](/reference/management-api/schema/workspace#workspacedelete) | Mutation | Soft-delete a non-live workspace. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workspaceDiff`](/reference/management-api/schema/workspace-version#workspacediff) | Query | Compute a structural diff between two workspace snapshots. Each side can be either a live workspace (diffed against its current draft snapshot) or a previously-published `WorkspaceVersion`. Requires authentication and `ORGANIZATION_PROJECTS_READ` scope on the project shared by both sides. |
-| [`workspaceDuplicate`](/reference/management-api/schema/workspace#workspaceduplicate) | Mutation | Duplicate an existing workspace with all of its child entities, including its workflows. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workspaceExport`](/reference/management-api/schema/workspace#workspaceexport) | Query | Export a workspace and every entity in it as a portable JSON bundle, with a manifest of the asset versions its content references. The asset bytes are not included; download each from its `downloadUrl`. Requires scope: `ORGANIZATION_PROJECTS_READ` on the workspace's project. |
-| [`workspaceImport`](/reference/management-api/schema/workspace#workspaceimport) | Mutation | Create a new draft workspace in a project from a bundle returned by `workspaceExport`, committing every entity in one transaction. Requires scope: `ORGANIZATION_PROJECTS_UPDATE` on the target project. |
-| [`workspacePublish`](/reference/management-api/schema/workspace#workspacepublish) | Mutation | Publish a workspace, creating an immutable version snapshot. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workspaceUnarchive`](/reference/management-api/schema/workspace#workspaceunarchive) | Mutation | Unarchive an archived workspace (restores it to `DRAFT`). Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workspaceUpdate`](/reference/management-api/schema/workspace#workspaceupdate) | Mutation | Rename an existing workspace. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
-| [`workspaceVersionPublish`](/reference/management-api/schema/workspace#workspaceversionpublish) | Mutation | Promote a previously-published `WorkspaceVersion` to be its project's served (live) version by pointing `projects.live_workspace_version_id` at it and stamping the owning workspace's `publishedAt` with that version's original publish timestamp. Works for the latest version (re-publish) or an earlier one (rollback, in product terms). No new `WorkspaceVersion` row is appended. The target workspace becomes the project's live one (an archived workspace is un-archived). The draft state is NOT modified, so if the draft differs from the published snapshot it shows up as "unpublished changes" in the UI. Use `workspaceDiff` with `(baseWorkspaceId, compareWorkspaceVersionId)` to preview the impact before invoking this mutation. Requires scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`accountCreate`](/reference/management-api/schema/auth#accountcreate) | Mutation | Registers an email address and emails it a confirmation code and link. The response does not reveal whether the address has an account. Returns `RATE_LIMITED` when the project's email quota is spent. |
+| [`accountResendVerification`](/reference/management-api/schema/auth#accountresendverification) | Mutation | Emails an existing account a new code and link: a confirmation, or a sign-in for a confirmed account. An address with no account returns an error, so the response reveals whether an account exists. An address emailed within the minimum send interval returns `RATE_LIMITED`. |
+| [`accountVerifyEmail`](/reference/management-api/schema/auth#accountverifyemail) | Mutation | Verifies the six-digit code from a confirmation or sign-in email and creates a session. |
+| [`action`](/reference/management-api/schema/action#action) | Query | Reads an action. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`actionCreate`](/reference/management-api/schema/action#actioncreate) | Mutation | Creates an action in a workspace. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`actionDelete`](/reference/management-api/schema/action#actiondelete) | Mutation | Deletes an action and the workflow it starts. An action that an experience references is not deleted, and comes back as an `IN_USE` user error. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`actions`](/reference/management-api/schema/action#actions) | Query | Lists the actions in a workspace. `search` matches a case-insensitive substring of the name; `sortKey` and `reverse` set the order. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`actionUpdate`](/reference/management-api/schema/action#actionupdate) | Mutation | Updates an action. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`apiKeyCreate`](/reference/management-api/schema/api-key#apikeycreate) | Mutation | Creates an API key and returns the full key, once. A blank name, no scopes, or a scope the caller does not hold or the key cannot carry returns `VALIDATION_ERROR`. Scope: `ORGANIZATION_API_KEYS_CREATE`. |
+| [`apiKeyRevoke`](/reference/management-api/schema/api-key#apikeyrevoke) | Mutation | Revokes an API key, which then stops authenticating at once. Cannot be undone; an unknown or revoked key returns `NOT_FOUND`. Scope: `ORGANIZATION_API_KEYS_DELETE`. |
+| [`apiKeys`](/reference/management-api/schema/api-key#apikeys) | Query | Lists an organisation's API keys, newest first. Revoked keys are left out. Scope: `ORGANIZATION_API_KEYS_READ`. |
+| [`asset`](/reference/management-api/schema/cms-models#asset) | Query | Reads an asset. Scope: `ORGANIZATION_PROJECTS_READ`. |
+| [`assetCommit`](/reference/management-api/schema/cms-models#assetcommit) | Mutation | Commits an uploaded file as the asset's current version, recording its size, MIME type and image dimensions. Fails when the bytes do not match the claimed content type. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`assetDelete`](/reference/management-api/schema/cms-models#assetdelete) | Mutation | Deletes an asset and its stored files. Fails with `CONFLICT` once a publish uses any of its versions; content entries that reference it are not checked. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`assets`](/reference/management-api/schema/cms-models#assets) | Query | Lists the assets in a project, newest first by default. Scope: `ORGANIZATION_PROJECTS_READ`. |
+| [`assetUploadInit`](/reference/management-api/schema/cms-models#assetuploadinit) | Mutation | Starts an asset upload and returns a pre-signed URL to PUT the bytes to. Nothing is stored until `assetCommit`. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`condition`](/reference/management-api/schema/condition#condition) | Query | Reads a condition. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`conditionCreate`](/reference/management-api/schema/condition#conditioncreate) | Mutation | Creates a condition in a workspace. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`conditionDelete`](/reference/management-api/schema/condition#conditiondelete) | Mutation | Deletes a condition. A condition that an experience or another condition references is not deleted, and comes back as an `IN_USE` user error. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`conditions`](/reference/management-api/schema/condition#conditions) | Query | Lists the conditions in a workspace. `search` matches a case-insensitive substring of the name; `sortKey` and `reverse` set the order. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`conditionUpdate`](/reference/management-api/schema/condition#conditionupdate) | Mutation | Updates a condition. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`contentBlock`](/reference/management-api/schema/cms-models#contentblock) | Query | Reads a block. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`contentBlockCreate`](/reference/management-api/schema/cms-models#contentblockcreate) | Mutation | Creates a block. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`contentBlockDelete`](/reference/management-api/schema/cms-models#contentblockdelete) | Mutation | Deletes a block. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`contentBlocks`](/reference/management-api/schema/cms-models#contentblocks) | Query | Lists the blocks in a workspace. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`contentBlockUpdate`](/reference/management-api/schema/cms-models#contentblockupdate) | Mutation | Updates a block. A schema change does not migrate the content entries that embed it. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`contentEntries`](/reference/management-api/schema/cms-models#contententries) | Query | Lists the content entries in a workspace. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`contentEntry`](/reference/management-api/schema/cms-models#contententry) | Query | Reads a content entry. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`contentEntryCreate`](/reference/management-api/schema/cms-models#contententrycreate) | Mutation | Creates a content entry of a model. Each asset reference without a version is pinned to the asset's current version. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`contentEntryDelete`](/reference/management-api/schema/cms-models#contententrydelete) | Mutation | Deletes a content entry. Fails with `CONFLICT` while a step uses it as its layout, or while another content entry references it. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`contentEntryUpdate`](/reference/management-api/schema/cms-models#contententryupdate) | Mutation | Updates the data of a content entry. Each asset reference without a version is pinned to the asset's current version. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`contentModel`](/reference/management-api/schema/cms-models#contentmodel) | Query | Reads a model. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`contentModelCreate`](/reference/management-api/schema/cms-models#contentmodelcreate) | Mutation | Creates a model. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`contentModelDelete`](/reference/management-api/schema/cms-models#contentmodeldelete) | Mutation | Deletes a model. Fails with `CONFLICT` while content entries use it, or while another schema's reference field targets it. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`contentModels`](/reference/management-api/schema/cms-models#contentmodels) | Query | Lists the models in a workspace. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`contentModelUpdate`](/reference/management-api/schema/cms-models#contentmodelupdate) | Mutation | Updates a model. A schema change migrates the data of its content entries and lists each removed value in `migrationWarnings`. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`createShopifyMetafieldConfig`](/reference/management-api/schema/shopify#createshopifymetafieldconfig) | Mutation | Creates a Shopify metafield config for a project. Scope: `ORGANIZATION_INTEGRATIONS_CREATE`. |
+| [`createShopifyWebhook`](/reference/management-api/schema/shopify#createshopifywebhook) | Mutation | Creates a Shopify webhook for a project and generates its HMAC secret. The result is the only place the secret appears. Scope: `ORGANIZATION_INTEGRATIONS_CREATE` and `ORGANIZATION_INTEGRATIONS_READ`. |
+| [`deleteShopifyMetafieldConfig`](/reference/management-api/schema/shopify#deleteshopifymetafieldconfig) | Mutation | Deletes a Shopify metafield config. Scope: `ORGANIZATION_INTEGRATIONS_DELETE`. |
+| [`deleteShopifyWebhook`](/reference/management-api/schema/shopify#deleteshopifywebhook) | Mutation | Deletes a Shopify webhook. Scope: `ORGANIZATION_INTEGRATIONS_DELETE`. |
+| [`designSystem`](/reference/management-api/schema/design-system#designsystem) | Query | Reads a design system. Scope: `ORGANIZATION_PROJECTS_READ`. |
+| [`designSystemCreate`](/reference/management-api/schema/design-system#designsystemcreate) | Mutation | Creates a design system from a committed Markdown asset. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`designSystemDelete`](/reference/management-api/schema/design-system#designsystemdelete) | Mutation | Deletes a design system. The asset that holds its guidance is kept. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`designSystems`](/reference/management-api/schema/design-system#designsystems) | Query | Lists the design systems in a project. Scope: `ORGANIZATION_PROJECTS_READ`. |
+| [`designSystemUpdate`](/reference/management-api/schema/design-system#designsystemupdate) | Mutation | Updates a design system's name or guidance asset. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`emailLinkVerify`](/reference/management-api/schema/auth#emaillinkverify) | Mutation | Verifies the link from a password-reset, invitation, sign-in or confirmation email and creates a session. The link works once: call this when the recipient confirms, never on opening the link, which an email security scanner may do before delivery. |
+| [`experience`](/reference/management-api/schema/experience#experience) | Query | Reads an experience. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`experienceCreate`](/reference/management-api/schema/experience#experiencecreate) | Mutation | Creates an experience in a workspace. A `PAGE` experience gets its single step and flow graph automatically. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`experienceDelete`](/reference/management-api/schema/experience#experiencedelete) | Mutation | Deletes an experience. Its steps, conditions and actions stay in the workspace. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`experienceFlowUpdate`](/reference/management-api/schema/experience#experienceflowupdate) | Mutation | Updates an experience's settings and flow graph, with the steps, conditions, actions and fields it uses, in one call. Validation runs before any write, and a change that fails it fails the whole call. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`experiences`](/reference/management-api/schema/experience#experiences) | Query | Lists the experiences in a workspace. `search` matches a case-insensitive substring of the name; `sortKey` and `reverse` set the order. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`experienceUpdate`](/reference/management-api/schema/experience#experienceupdate) | Mutation | Updates an experience's settings. `experienceFlowUpdate` changes its flow graph. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`externalApi`](/reference/management-api/schema/external-api#externalapi) | Query | Reads an external API. Null when it does not exist. Scope: `ORGANIZATION_INTEGRATIONS_READ`. |
+| [`externalApiAuthHeaderClear`](/reference/management-api/schema/external-api#externalapiauthheaderclear) | Mutation | Removes the static auth header of an external API. An external API with no static header is unchanged. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`externalApiAuthHeaderSet`](/reference/management-api/schema/external-api#externalapiauthheaderset) | Mutation | Sets the static auth header of an external API, and removes any OAuth2 credential. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`externalApiCreate`](/reference/management-api/schema/external-api#externalapicreate) | Mutation | Creates an external API in a project, with an optional credential. Scope: `ORGANIZATION_INTEGRATIONS_CREATE`. |
+| [`externalApiDelete`](/reference/management-api/schema/external-api#externalapidelete) | Mutation | Deletes an external API and its credential. Workflows then cannot call its origin. Scope: `ORGANIZATION_INTEGRATIONS_DELETE`. |
+| [`externalApiOAuth2Clear`](/reference/management-api/schema/external-api#externalapioauth2clear) | Mutation | Removes the OAuth2 credential of an external API, with its secrets and cached access token. An external API with no OAuth2 credential is unchanged. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`externalApiOAuth2Set`](/reference/management-api/schema/external-api#externalapioauth2set) | Mutation | Sets the OAuth2 credential of an external API, and removes any static auth header. The next call fetches a new access token. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`externalApiUpdate`](/reference/management-api/schema/external-api#externalapiupdate) | Mutation | Updates the name of an external API. To change the origin, delete it and create another. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`feature`](/reference/management-api/schema/feature#feature) | Query | Reads a feature flag by its ID and workspace. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`featureCreate`](/reference/management-api/schema/feature#featurecreate) | Mutation | Creates a feature flag in a workspace. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`featureDelete`](/reference/management-api/schema/feature#featuredelete) | Mutation | Deletes a feature flag. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`features`](/reference/management-api/schema/feature#features) | Query | Lists the feature flags in a workspace. `search` matches a case-insensitive substring of the name; `sortKey` and `reverse` set the order. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`featureUpdate`](/reference/management-api/schema/feature#featureupdate) | Mutation | Updates a feature flag. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`feedbackCreate`](/reference/management-api/schema/feedback#feedbackcreate) | Mutation | Sends product feedback from the signed-in user to the Picked team. |
+| [`field`](/reference/management-api/schema/field#field) | Query | Reads a field. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`fieldCreate`](/reference/management-api/schema/field#fieldcreate) | Mutation | Creates a field in a workspace. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`fieldDelete`](/reference/management-api/schema/field#fielddelete) | Mutation | Deletes a field. A field that is on a step is not deleted, and comes back as an `IN_USE` user error. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`fields`](/reference/management-api/schema/field#fields) | Query | Lists the fields in a workspace. `search` matches a case-insensitive substring of the name; `sortKey` and `reverse` set the order. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`fieldUpdate`](/reference/management-api/schema/field#fieldupdate) | Mutation | Updates a field. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`integrationConfigurationCreate`](/reference/management-api/schema/integration#integrationconfigurationcreate) | Mutation | Creates the configuration of an installed integration. An integration has at most one configuration; a second gets a `CONFLICT` error. Scope: `ORGANIZATION_INTEGRATIONS_CREATE`. |
+| [`integrationConfigurationDelete`](/reference/management-api/schema/integration#integrationconfigurationdelete) | Mutation | Deletes an integration's configuration. The integration stays installed. Scope: `ORGANIZATION_INTEGRATIONS_DELETE`. |
+| [`integrationConfigurationUpdate`](/reference/management-api/schema/integration#integrationconfigurationupdate) | Mutation | Updates an integration's configuration. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`integrationInstall`](/reference/management-api/schema/integration#integrationinstall) | Mutation | Installs an integration for a project. A project that already has an integration of that type gets a `CONFLICT` error. Scope: `ORGANIZATION_INTEGRATIONS_CREATE` and `ORGANIZATION_PROJECTS_READ`. |
+| [`integrationUninstall`](/reference/management-api/schema/integration#integrationuninstall) | Mutation | Uninstalls an integration and deletes its configuration. Scope: `ORGANIZATION_INTEGRATIONS_DELETE`. |
+| [`labelsDelete`](/reference/management-api/schema/label#labelsdelete) | Mutation | Deletes labels from a lead, a project or a workflow run. Deleting a label that is not set succeeds. A `LEAD` owner needs `ORGANIZATION_LEADS_UPDATE`; the other owners need `ORGANIZATION_PROJECTS_UPDATE`. Scope: `ORGANIZATION_LEADS_UPDATE` or `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`labelsSet`](/reference/management-api/schema/label#labelsset) | Mutation | Creates or replaces labels on a lead, a project or a workflow run. Labels the call does not name are unchanged. A `LEAD` owner needs `ORGANIZATION_LEADS_UPDATE`; the other owners need `ORGANIZATION_PROJECTS_UPDATE`. Scope: `ORGANIZATION_LEADS_UPDATE` or `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`lead`](/reference/management-api/schema/lead#lead) | Query | Reads a lead. Scope: `ORGANIZATION_LEADS_READ`. |
+| [`leadDelete`](/reference/management-api/schema/lead#leaddelete) | Mutation | Deletes a lead and its labels. This cannot be undone. Scope: `ORGANIZATION_LEADS_DELETE`. |
+| [`magicLinkSend`](/reference/management-api/schema/auth#magiclinksend) | Mutation | Emails an existing account a sign-in code and link. Never creates an account, and answers `success: true` for an address with no account. |
+| [`magicLinkVerify`](/reference/management-api/schema/auth#magiclinkverify) | Mutation | Verifies the six-digit code from a sign-in or confirmation email and creates a session. |
+| [`mcpServer`](/reference/management-api/schema/mcp-server#mcpserver) | Query | Reads an MCP server. Null when no server has the ID. Scope: `ORGANIZATION_INTEGRATIONS_READ`. |
+| [`mcpServerAuthHeaderClear`](/reference/management-api/schema/mcp-server#mcpserverauthheaderclear) | Mutation | Removes an MCP server's auth header. Succeeds when the server has none. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`mcpServerAuthHeaderSet`](/reference/management-api/schema/mcp-server#mcpserverauthheaderset) | Mutation | Sets or replaces the auth header sent to an MCP server. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`mcpServerDelete`](/reference/management-api/schema/mcp-server#mcpserverdelete) | Mutation | Deletes an MCP server with its stored URL and auth header. Cannot be undone; an unknown ID returns `NOT_FOUND`. Scope: `ORGANIZATION_INTEGRATIONS_DELETE`. |
+| [`mcpServerRegister`](/reference/management-api/schema/mcp-server#mcpserverregister) | Mutation | Registers a third-party MCP server to a project. Scope: `ORGANIZATION_INTEGRATIONS_CREATE`. |
+| [`mcpServerUpdate`](/reference/management-api/schema/mcp-server#mcpserverupdate) | Mutation | Renames an MCP server. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`mcpServerUrlSet`](/reference/management-api/schema/mcp-server#mcpserverurlset) | Mutation | Replaces an MCP server's URL. The result shows only `urlDisplay`. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`mfaChallengeCreate`](/reference/management-api/schema/auth#mfachallengecreate) | Mutation | Opens a challenge against one of the caller's factors. |
+| [`mfaChallengeVerify`](/reference/management-api/schema/auth#mfachallengeverify) | Mutation | Verifies an authenticator code against a challenge and returns the caller's session at `AAL2`. The user's other sessions keep their level. A wrong code returns `MFA_CHALLENGE_FAILED`, and an expired challenge `TOKEN_EXPIRED`. |
+| [`mfaFactorEnroll`](/reference/management-api/schema/auth#mfafactorenroll) | Mutation | Enrols an authenticator app for the caller and returns its secret, once. First deletes the caller's unverified factors, except the two newest enrolled in the last minute; one holding the given `friendlyName` is deleted however new. |
+| [`mfaFactorUnenroll`](/reference/management-api/schema/auth#mfafactorunenroll) | Mutation | Removes one of the caller's factors. Removing a verified factor needs an `AAL2` session, and otherwise returns `MFA_REQUIRED`. A user the MFA policy requires cannot remove their last verified factor (`VALIDATION_ERROR`). |
+| [`oauthAuthorize`](/reference/management-api/schema/auth#oauthauthorize) | Mutation | Creates the provider URL that starts a sign-in with an OAuth provider. |
+| [`oauthCallback`](/reference/management-api/schema/auth#oauthcallback) | Mutation | Exchanges the authorisation code from an OAuth provider's redirect for a session. |
+| [`oauthConsentApprove`](/reference/management-api/schema/auth#oauthconsentapprove) | Mutation | Approves an OAuth authorisation request for the signed-in user. |
+| [`oauthConsentDeny`](/reference/management-api/schema/auth#oauthconsentdeny) | Mutation | Denies an OAuth authorisation request for the signed-in user. |
+| [`oauthConsentDetails`](/reference/management-api/schema/auth#oauthconsentdetails) | Query | Reads an OAuth authorisation request waiting for the signed-in user's consent. Reading a request the user already consented to approves it. |
+| [`organization`](/reference/management-api/schema/organization#organization) | Query | Reads an organisation by ID or slug. Null when no organisation matches. Scope: `ORGANIZATION_READ`. |
+| [`organizationClientManagerScopesUpdate`](/reference/management-api/schema/organization#organizationclientmanagerscopesupdate) | Mutation | Sets the scopes a client manager holds in one organisation. The caller cannot edit their own scopes, and a client manager can add or remove only scopes they hold there themselves. Scope: `STAFF_INVITE_CLIENT_MANAGER`. |
+| [`organizationCreate`](/reference/management-api/schema/organization#organizationcreate) | Mutation | Creates an organisation owned by the calling user. Scope: `ORGANIZATION_CREATE`. |
+| [`organizationDelete`](/reference/management-api/schema/organization#organizationdelete) | Mutation | Deletes an organisation. Scope: `ORGANIZATION_DELETE`. |
+| [`organizationInvitationAccept`](/reference/management-api/schema/organization#organizationinvitationaccept) | Mutation | Accepts an invitation, making the calling user a member with the scopes it carries. The invitation is used up. An unknown or expired token, or an existing membership, fails. |
+| [`organizationInvitationDecline`](/reference/management-api/schema/organization#organizationinvitationdecline) | Mutation | Declines an invitation addressed to the calling user's email address and deletes it. |
+| [`organizationInvitationRevoke`](/reference/management-api/schema/organization#organizationinvitationrevoke) | Mutation | Revokes a pending invitation, so its token stops working. Scope: `ORGANIZATION_INVITATIONS_DELETE`. |
+| [`organizationMemberInvite`](/reference/management-api/schema/organization#organizationmemberinvite) | Mutation | Invites an email address to an organisation and emails the invitee. `delivery` says which email went out. Scope: `ORGANIZATION_INVITATIONS_CREATE`. |
+| [`organizationMemberRemove`](/reference/management-api/schema/organization#organizationmemberremove) | Mutation | Removes a member from an organisation, with every scope they held there. The primary owner cannot be removed. Scope: `ORGANIZATION_MEMBERS_DELETE`. |
+| [`organizationMemberScopesUpdate`](/reference/management-api/schema/organization#organizationmemberscopesupdate) | Mutation | Sets the scopes a member holds in an organisation. The caller cannot edit their own scopes, grant a scope they do not hold, or take `ORGANIZATION_MEMBERS_MANAGE_SCOPES` from the primary owner. Scope: `ORGANIZATION_MEMBERS_MANAGE_SCOPES`. |
+| [`organizations`](/reference/management-api/schema/organization#organizations) | Query | Lists the organisations the user belongs to. `search` matches a case-insensitive substring of the name. Empty for an API key. |
+| [`organizationShopifyWebhooks`](/reference/management-api/schema/shopify#organizationshopifywebhooks) | Query | Lists an organisation's Shopify webhooks. Scope: `ORGANIZATION_INTEGRATIONS_READ`. |
+| [`organizationUpdate`](/reference/management-api/schema/organization#organizationupdate) | Mutation | Updates an organisation. Scope: `ORGANIZATION_UPDATE`. |
+| [`passwordResetSend`](/reference/management-api/schema/auth#passwordresetsend) | Mutation | Sends a password-reset email. Returns `RATE_LIMITED` when the address was emailed within the minimum send interval or the project's email quota is spent. |
+| [`passwordUpdate`](/reference/management-api/schema/auth#passwordupdate) | Mutation | Sets the signed-in user's password without asking for the current one. Ends the user's other sessions and keeps the caller's. An `AAL1` session may set a password only while the user holds no verified factor, and otherwise gets `MFA_REQUIRED`. |
+| [`pickedqlQuery`](/reference/management-api/schema/analytics#pickedqlquery) | Query | Runs a PickedQL query against one project's analytics data. A statement that does not parse, or queries a project's data without a `project_id` filter, fails with `VALIDATION_ERROR`. Scope: `ORGANIZATION_REPORTS_READ`. |
+| [`ping`](/reference/management-api/schema/common#ping) | Query | Checks that the API is up. Answers `pong`. |
+| [`project`](/reference/management-api/schema/project#project) | Query | Reads a project. Null when no project has the ID. Scope: `ORGANIZATION_PROJECTS_READ`. |
+| [`projectCreate`](/reference/management-api/schema/project#projectcreate) | Mutation | Creates a project, with a draft workspace named `Default`. Scope: `ORGANIZATION_PROJECTS_CREATE`. |
+| [`projectDelete`](/reference/management-api/schema/project#projectdelete) | Mutation | Deletes a project. Scope: `ORGANIZATION_PROJECTS_DELETE`. |
+| [`projectPreviewEnvironmentCreate`](/reference/management-api/schema/project#projectpreviewenvironmentcreate) | Mutation | Creates a preview environment on a project. Invalid input comes back as `userErrors`. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`projectPreviewEnvironmentDelete`](/reference/management-api/schema/project#projectpreviewenvironmentdelete) | Mutation | Deletes a preview environment. An unknown ID comes back as `userErrors`. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`projectPreviewEnvironmentUpdate`](/reference/management-api/schema/project#projectpreviewenvironmentupdate) | Mutation | Updates a preview environment. Invalid input comes back as `userErrors`. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`projects`](/reference/management-api/schema/project#projects) | Query | Lists the projects the user can reach, across every organisation they belong to. `search` matches a case-insensitive substring of the name. Empty for an API key. |
+| [`projectShopifyMetafieldConfigs`](/reference/management-api/schema/shopify#projectshopifymetafieldconfigs) | Query | Lists a project's Shopify metafield configs. Scope: `ORGANIZATION_INTEGRATIONS_READ`. |
+| [`projectUpdate`](/reference/management-api/schema/project#projectupdate) | Mutation | Updates a project's name or brief. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`report`](/reference/management-api/schema/report#report) | Query | Reads a project report. Null when no project report has the ID. Scope: `ORGANIZATION_REPORTS_READ`. |
+| [`reportCreate`](/reference/management-api/schema/report#reportcreate) | Mutation | Creates a report and adds it to a project. Scope: `ORGANIZATION_REPORTS_CREATE`. |
+| [`reportDelete`](/reference/management-api/schema/report#reportdelete) | Mutation | Deletes a report from its project, and the report itself when no other project uses it. Scope: `ORGANIZATION_REPORTS_DELETE`. |
+| [`reportUpdate`](/reference/management-api/schema/report#reportupdate) | Mutation | Updates a project report and its report. Scope: `ORGANIZATION_REPORTS_UPDATE`. |
+| [`savedView`](/reference/management-api/schema/saved-view#savedview) | Query | Reads a saved view. Scope: `ORGANIZATION_PROJECTS_READ`. |
+| [`savedViewCreate`](/reference/management-api/schema/saved-view#savedviewcreate) | Mutation | Creates a saved view of a list in a project. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`savedViewDelete`](/reference/management-api/schema/saved-view#savedviewdelete) | Mutation | Deletes a saved view. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`savedViewUpdate`](/reference/management-api/schema/saved-view#savedviewupdate) | Mutation | Updates a saved view: its name, its controls, or whether it is the default. Scope: `ORGANIZATION_PROJECTS_UPDATE`. |
+| [`sessionCreate`](/reference/management-api/schema/auth#sessioncreate) | Mutation | Signs in with an email address and password and returns an `AAL1` session. |
+| [`sessionRefresh`](/reference/management-api/schema/auth#sessionrefresh) | Mutation | Exchanges a refresh token for a new session. |
+| [`sessionStart`](/reference/management-api/schema/auth#sessionstart) | Mutation | Begins a sign-in from an email address alone: answers `PASSWORD`, or emails a sign-in code and answers `EMAIL_CODE`. Never creates an account. Returns `RATE_LIMITED` past 10 requests a minute from one IP address, or when the project's email quota is spent. |
+| [`shopifyCollectionContentUpdate`](/reference/management-api/schema/shopify#shopifycollectioncontentupdate) | Mutation | Updates the content at `key` of a Shopify collection, stored in its app metafield `content.<key>`. Keeps up to nine earlier values. The shop must belong to the calling API key's organisation. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`shopifyMetafieldConfigCreate`](/reference/management-api/schema/shopify#shopifymetafieldconfigcreate) | Mutation | Creates a Shopify metafield config for a project. Scope: `ORGANIZATION_INTEGRATIONS_CREATE`. |
+| [`shopifyMetafieldConfigDelete`](/reference/management-api/schema/shopify#shopifymetafieldconfigdelete) | Mutation | Deletes a Shopify metafield config. Scope: `ORGANIZATION_INTEGRATIONS_DELETE`. |
+| [`shopifyMetafieldConfigs`](/reference/management-api/schema/shopify#shopifymetafieldconfigs) | Query | Lists a project's Shopify metafield configs. Scope: `ORGANIZATION_INTEGRATIONS_READ`. |
+| [`shopifyMetafieldConfigUpdate`](/reference/management-api/schema/shopify#shopifymetafieldconfigupdate) | Mutation | Updates a Shopify metafield config. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`shopifyProduct`](/reference/management-api/schema/shopify#shopifyproduct) | Query | Reads a Shopify product. Always returns null. |
+| [`shopifyProductContentUpdate`](/reference/management-api/schema/shopify#shopifyproductcontentupdate) | Mutation | Updates the content at `key` of a Shopify product, stored in its app metafield `content.<key>`. Keeps up to nine earlier values. The shop must belong to the calling API key's organisation. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`shopifyProducts`](/reference/management-api/schema/shopify#shopifyproducts) | Query | Lists Shopify products. Always returns an empty page. |
+| [`shopifyWebhookCreate`](/reference/management-api/schema/shopify#shopifywebhookcreate) | Mutation | Creates a Shopify webhook for a project and generates its HMAC secret. The result is the only place the secret appears. Scope: `ORGANIZATION_INTEGRATIONS_CREATE` and `ORGANIZATION_INTEGRATIONS_READ`. |
+| [`shopifyWebhookDelete`](/reference/management-api/schema/shopify#shopifywebhookdelete) | Mutation | Deletes a Shopify webhook. Scope: `ORGANIZATION_INTEGRATIONS_DELETE`. |
+| [`shopifyWebhooks`](/reference/management-api/schema/shopify#shopifywebhooks) | Query | Lists an organisation's Shopify webhooks. Scope: `ORGANIZATION_INTEGRATIONS_READ`. |
+| [`shopifyWebhookUpdate`](/reference/management-api/schema/shopify#shopifywebhookupdate) | Mutation | Updates a Shopify webhook. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`step`](/reference/management-api/schema/step#step) | Query | Reads a step. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`stepCreate`](/reference/management-api/schema/step#stepcreate) | Mutation | Creates a step in a workspace. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`stepDelete`](/reference/management-api/schema/step#stepdelete) | Mutation | Deletes a step. A step that an experience references is not deleted, and comes back as an `IN_USE` user error. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`steps`](/reference/management-api/schema/step#steps) | Query | Lists the steps in a workspace. `search` matches a case-insensitive substring of the name; `sortKey` and `reverse` set the order. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`stepUpdate`](/reference/management-api/schema/step#stepupdate) | Mutation | Updates a step. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`tenant`](/reference/management-api/schema/tenant-branding#tenant) | Query | Reads a tenant and its branding by slug or hostname. Returns the default tenant when neither matches. Needs no authentication, and responses are cacheable for 5 minutes. |
+| [`updateShopifyCollectionContent`](/reference/management-api/schema/shopify#updateshopifycollectioncontent) | Mutation | Updates the content at `key` of a Shopify collection, stored in its app metafield `content.<key>`. Keeps up to nine earlier values. The shop must belong to the calling API key's organisation. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`updateShopifyMetafieldConfig`](/reference/management-api/schema/shopify#updateshopifymetafieldconfig) | Mutation | Updates a Shopify metafield config. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`updateShopifyProductContent`](/reference/management-api/schema/shopify#updateshopifyproductcontent) | Mutation | Updates the content at `key` of a Shopify product, stored in its app metafield `content.<key>`. Keeps up to nine earlier values. The shop must belong to the calling API key's organisation. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`updateShopifyWebhook`](/reference/management-api/schema/shopify#updateshopifywebhook) | Mutation | Updates a Shopify webhook. Scope: `ORGANIZATION_INTEGRATIONS_UPDATE`. |
+| [`user`](/reference/management-api/schema/auth#user) | Query | Reads the signed-in user. Null when the caller is an API key or the auth service rejects the token. Exempt from the MFA policy, so a user the policy gates can read `mfa` and `mfaFactors`. |
+| [`viewerScopes`](/reference/management-api/schema/auth#viewerscopes) | Query | Lists the scopes the caller holds outside any organisation, such as `ORGANIZATION_CREATE`. Empty for an API key. `Organization.viewerScopes` lists the scopes held in one organisation. |
+| [`workbenchAssetAdoptOwned`](/reference/management-api/schema/workbench#workbenchassetadoptowned) | Mutation | Moves the ownership of an asset-library asset to a workbench, as `OWNED`. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workbenchAssetImport`](/reference/management-api/schema/workbench#workbenchassetimport) | Mutation | Imports an asset owned elsewhere into a workbench as `IMPORTED`. The asset's owner does not change. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workbenchAssetRemove`](/reference/management-api/schema/workbench#workbenchassetremove) | Mutation | Removes an asset from a workbench. Removing an `OWNED` asset also deletes it, which needs `ORGANIZATION_PROJECTS_UPDATE` and fails once a publish uses the asset. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workflow`](/reference/management-api/schema/workflow#workflow) | Query | Reads a workflow. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`workflowCreate`](/reference/management-api/schema/workflow#workflowcreate) | Mutation | Creates a workflow in a workspace. The caller must hold the scopes the tools of the graph need, as `Workflow.scopes` describes. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workflowDelete`](/reference/management-api/schema/workflow#workflowdelete) | Mutation | Deletes a workflow. Published versions keep their copy, and an action that started it can start another workflow. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workflowGraphUpdate`](/reference/management-api/schema/workflow#workflowgraphupdate) | Mutation | Updates the graph of a workflow with a change set, all or nothing. A refused change set writes nothing and comes back in `errors`. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workflowRun`](/reference/management-api/schema/workflow-run#workflowrun) | Query | Reads a workflow run. Scope: `ORGANIZATION_PROJECTS_READ`. |
+| [`workflows`](/reference/management-api/schema/workflow#workflows) | Query | Lists the workflows in a workspace. `search` matches a case-insensitive substring of the name. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`workflowTestRun`](/reference/management-api/schema/workflow#workflowtestrun) | Mutation | Tests a workflow by walking its draft graph once, holding back every write. Nothing is stored, and the caller must also hold every scope in `Workflow.scopes`. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workflowTools`](/reference/management-api/schema/workflow#workflowtools) | Query | Lists every tool a workflow node can run, with the arguments each takes. |
+| [`workflowUpdate`](/reference/management-api/schema/workflow#workflowupdate) | Mutation | Updates the name or the node visit limit of a workflow. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workspace`](/reference/management-api/schema/workspace#workspace) | Query | Reads a workspace. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`workspaceArchive`](/reference/management-api/schema/workspace#workspacearchive) | Mutation | Archives a workspace, which moves it out of the default list. It stays editable. Archiving an archived workspace changes nothing. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workspaceContentEntryValidation`](/reference/management-api/schema/cms-models#workspacecontententryvalidation) | Query | Verifies each content entry in a workspace against its model's schema, including embedded blocks. It changes no data. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`workspaceCreate`](/reference/management-api/schema/workspace#workspacecreate) | Mutation | Creates an empty draft workspace in a project. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workspaceDelete`](/reference/management-api/schema/workspace#workspacedelete) | Mutation | Deletes a workspace that is not live. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workspaceDiff`](/reference/management-api/schema/workspace-version#workspacediff) | Query | Compares two workspace snapshots and lists the entities added, removed and modified. Each side is a workspace at its current content or a published version, and both sides must belong to one project. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`workspaceDuplicate`](/reference/management-api/schema/workspace#workspaceduplicate) | Mutation | Copies a workspace and every entity in it, workflows included, into a new draft workspace in the same project. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workspaceExport`](/reference/management-api/schema/workspace#workspaceexport) | Query | Exports a workspace and every entity in it as a JSON bundle that `workspaceImport` reads. The bundle lists the asset versions its content references; download each file from its `downloadUrl`. Scope: `ORGANIZATION_WORKSPACE_READ`. |
+| [`workspaceImport`](/reference/management-api/schema/workspace#workspaceimport) | Mutation | Creates a draft workspace in a project from a bundle that `workspaceExport` returned. Every entity gets a new ID, and every reference between entities, assets through `assetMap` included, points at the new IDs. Nothing is created when a `userError` is returned. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workspacePublish`](/reference/management-api/schema/workspace#workspacepublish) | Mutation | Publishes a workspace: makes an immutable version of it and serves that version to visitors. The workspace becomes `LIVE`, and an archived workspace returns to the default list. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workspaceUnarchive`](/reference/management-api/schema/workspace#workspaceunarchive) | Mutation | Unarchives a workspace, which returns it to `DRAFT`. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workspaceUpdate`](/reference/management-api/schema/workspace#workspaceupdate) | Mutation | Renames a workspace. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
+| [`workspaceVersionPublish`](/reference/management-api/schema/workspace#workspaceversionpublish) | Mutation | Makes a published version the version its project serves. No new version is made and the workspace's draft does not change; the workspace becomes `LIVE`, and an archived one returns to the default list. Scope: `ORGANIZATION_WORKSPACE_UPDATE`. |
 
 ## Domains