workspace argument holding a subdomain. Leave it
off and the tool runs against the connection’s default workspace.
What a tool returns depends on how you connected. Over OAuth, listings are
filtered to what your account can see and a record you cannot open is refused.
With an API key there is no user to filter by, so tools reach the whole
workspace. See Authentication.
Discovery
search and fetch are the pair a client uses to look something up and then
read it, so an assistant that only knows a form’s name can still reach it.
Forms
ListSubmissions strips internal bookkeeping out of each answer before it
returns: record ids, positions, timestamps and the signed URLs behind uploaded
files. Photo and signature answers come back as a filename rather than a link.
Team members
CreateTeamMember is all-or-nothing. Every address must be a well-formed email,
and if any address or the role is rejected nobody is added, so a failed call
leaves the workspace unchanged and is safe to retry. The error names every
address at fault. An email that already belongs to the workspace is reactivated
rather than duplicated, and its organization role is overwritten.
Organization role names are matched against the roles in your workspace and are
case-sensitive. If the assistant reports an unknown role, the error lists the
roles that exist.
Permissions
Over OAuth, the four team-member write tools andGetTeamMember also check your
own permissions before doing anything: viewing members needs a role that can view
them, and inviting, updating or deactivating needs one that can manage them.
Changing someone’s organization role needs the permission to manage roles as
well. An API key connection carries no user, so these checks do not apply.