site_access tools

​

site_access_clear

Tier: destructive · Tags: delete, site_access Remove access from one site in a workspace. Other sites keep theirs. The target is ONE of origin (a URL), site (a site’s name) or app_artifact, and is required. A target no site answers on is [not_found], naming the sites that hold access. The site itself and its hosts stay. workspace_id: UUID or short alias (e.g. w-6ec). method: "basic_auth" / "cookie" / "login" / "public" / "all" (every method the site holds). origin / site / app_artifact: the site, as for site_access_set. Returns {"method", "site": <name>, "cleared": [<method>, ...]} ([] when the site held none of them).

​

Parameters

​

site_access_get

Tier: read-only · Tags: read, site_access Show every site in a workspace and the access each one holds. A site is one web site (its hosts, e.g. shop.com and shop.se or localhost:3000; www and bare are one host) or one app, and it owns its own basic auth, session cookie, login, or the statement that it is public. A run uses the access of the site its URL belongs to and nothing else; a URL no site covers runs with no access. Hosts only pick the site: basic auth and the cookie go to one origin, the one the run opens (the study URL’s, or its tunnel’s), never to all of a site’s hosts. Configure with site_access_set. Mirrors ish workspace site-access status. workspace_id: UUID or short alias (e.g. w-6ec) of the workspace. cookie_expires_at / cookie_expired ride on a site with a cookie: the worker refuses an interactive run once the cookie has expired (session_cookie_expired), so re-register it when cookie_expired. unassigned_hosts lists hosts this workspace’s browser studies target that no site covers, with how many studies target each. Credential values are never returned. Returns {"sites": [{"name", "hosts", "app_artifact", "methods": {"basic_auth", "session_cookie", "login", "public"}}], "unassigned_hosts": [{"host", "study_count"}]}.

​

Parameters

​

site_access_set

Tier: write · Tags: site_access, write Give one site in a workspace its access so ish’s cloud browser can reach a login-gated URL without publishing it. Polymorphic on method. workspace_id: UUID or short alias (e.g. w-6ec). The target is ONE of origin (a URL; its site is created on first use), site (an existing site’s name, from site_access_get) or app_artifact (an app). With none, the workspace base_url is the origin (not for hosts, which must name the site). An origin on another host is another site: it never overwrites the first site’s access. created says a new site was made (check it against other_sites_with_access for a typo). To make one site answer on several hosts, use method="hosts". Basic auth and the cookie go to one origin, the one the run opens (the study URL’s, or its tunnel’s), never to all of a site’s hosts.

• basic_auth - HTTP basic auth. Requires username + password.
• cookie - a session cookie (Vercel preview, Lovable, etc.). Requires name + value. Pass expires_at when you know it; else the backend derives one (a JWT exp, a per-host hint, else ONE HOUR). Past it, runs fail (session_cookie_expired); re-register to extend.
• login - credentials for the site’s OWN login form. Requires username + password. Best effort, not a gate: the participant types them only if it meets a sign-in form. The only credential an app takes.
• public - state the site needs no access. Refused ([conflict]) while the site holds a credential; saving a credential withdraws it.
• hosts - replaces the extra hosts (e.g. shop.se, auth.shop.com, localhost:3000; [] removes them); to add one, pass the site’s current hosts from site_access_get plus the new one (the first host is the address and is ignored). www and bare are one host. Hosts only pick the site a study URL belongs to. A host another site holds is [conflict]. Web sites only.

method: "basic_auth" / "cookie" / "login" / "public" / "hosts". origin: URL of the site, e.g. https://preview.example.com. site: name of an existing site. app_artifact: an app’s artifact. username / password: basic_auth and login. Never returned. name / value: the cookie’s; cookie only. Never returned. expires_at: cookie only; ISO-8601 (UTC without an offset), future. hosts: hosts only. Returns {"method", "site": <site_access_get's site>, "created", "cleared_public_affirmation"}, plus other_sites_with_access when created.

​

Parameters