Abilities reference

Every action this site supports for you, with input schemas.

The signed-in user.

Verify a code from the authenticator app and enable two-factor sign-in.

Turn off two-factor sign-in (needs your password).

Generate a TOTP secret. Confirm with account/two-factor-confirm.

Change name, email, locale, preferences, profile fields (data) or password (password changes need the current password).

Every item of the sidebar or the home screen and an arrangement of them (the saved one, the given one, or the defaults when layout is null). Save with settings/update (namespace "admin", value "sidebar" or "dashboard").

Views per page (with the entry it shows) or language for a period, most first. In visitors mode also visitors per page, entry page (where visits started), source (referring site or campaign; "Direct" when none), device, browser or operating system; in counts mode (the default) those answer {unavailable: "mode"}.

Page views for a period, the same number for the period before (to compare) and one row per day. In visitors mode also visitors, views per visit, bounce rate and how many people are on the site now; in counts mode (the default, see `mode`) those are null.

One of your chats as shown in the panel, with calls waiting for approval.

Delete one of your chats.

Give one of your chats a short name from how it starts.

Your recent chats with the assistant, newest first.

One context resource, for a chat that attaches it.

What @ offers in a chat besides content: the context resources this person may read.

What / offers in a chat: the skills this person may use.

Whether the assistant is set up, the models to pick from and the default one.

What to ask next, given what is on view. For a new chat.

Recent changes made through abilities, newest first.

The latest changes across the site in plain words: who did what to which entry, page or setting, and through which channel (admin, agent, API, CLI). Repeated saves of the same thing are folded into one item with a count.

Convert Block Markdown (Markdown plus ::: directives for other blocks) into a block tree.

Search the Phosphor icon set for the Icon and Button blocks. Append -bold, -fill or -light to a name for other weights.

Convert a block tree to Block Markdown.

Every block type (props, children, examples), every style property and variant, data sources for Repeat, and the schema of scripts (logic) and animations (motion). Compose pages from these.

Transactional email totals from Brevo for the last 7 days: requests, delivered, unique opens and clicks, bounces, blocked and spam reports. state is "ok", "inactive" (Brevo is not the mail transport), "no-key" or "error" (with a message). Cached for 10 minutes.

Say you have an entry open (and whether you are editing); returns who else has it open and when it was last saved.

Delete a collection definition. Nonempty collections require deleteEntries true; entries, drafts and history are removed.

A collection definition with its fields, the JSON schema entry data must follow, and its settings as fields.

All content collections (content types) with their routes and structure.

Initial collection definition defaults and settings from the active plugins. Apply defaults before explicit creation settings; without the blocks plugin a new collection can contain fields only.

Each content collection you can view with how many entries it has in the default language, how many of them are drafts, and when one last changed.

Create or update a collection definition (fields, route, structure). Written to content/collections/<handle>.yaml.

Comment on an entry, or reply to a thread with parentId. mentions are user ids (see comments/people); they get an email.

Delete your comment (moderators can delete any). Deleting a thread’s first comment deletes its replies.

Open threads that mention you or sit on entries you created, newest first.

Comment threads on an entry (open threads first), with replies and mentions.

Admin users who can see an entry and can be @mentioned on it.

Mark a thread as resolved (or reopen it with resolved: false).

Change the text of your comment.

The most recently changed entries across collections you can view.

Find entries across collections, ranking title and slug matches before content matches.

Replace the site’s custom.css or custom.js (content/design). CSS is appended after everything else; JS loads as an ES module on every page and may register Alpine components (document.addEventListener("cms:alpine", (e) => e.detail.data("name", () => ({…})))) that elements use through logic.component.

Download a Google Fonts family (latin, variable weights when available) into content/design/fonts so it is self-hosted, and add it to the design system. Then use it in a font token.

Add a .woff2 file (base64) to content/design/fonts and the design system.

The site’s design system (content/design): tokens (use as token:group.name in styles), fonts, element styles, prose styles, button variants, page transition, breakpoints, custom CSS and JS, and the templates entries can use.

The stylesheet the site would get with these changes (the design/update input, plus css), without saving. For live previews.

Change tokens (e.g. {"color.primary": "#0f766e"}; values may be CSS or {"min","max"} for fluid sizes), dark-mode values (null clears), renames, element styles, prose styles, button variants, fonts or the page transition. Sections you pass replace the stored ones. The site rebuilds.

Create an entry. `data` keys are the collection's field handles (see collections/get for the schema). Created as a draft unless status is "published".

Permanently delete an entry. Children of tree entries move up one level.

Throw away unpublished changes of a published entry.

Copy an entry (as a draft).

One entry with its working copy (draft changes included) and data fields.

Query entries of a collection with filters, search, sorting and pagination.

Summaries for a list of entry ids (any collection you can view), in the given order.

Move an entry immediately without publishing its draft. Moving published content requires publishing permission.

Publish an entry (applying its draft). Pass `at` to schedule.

Set the order of sibling entries (and move them under parentId for trees).

Restore an entry to a previous revision (as a draft for published entries).

A single revision snapshot.

Revisions of an entry, newest first.

All entries of a tree collection (e.g. pages) nested by parent.

Take an entry offline (it becomes a draft).

Change an entry. `data` is merged into existing data. For published entries changes are saved as a draft until published (or pass publish: true).

Available field types and their options, for building blueprints.

Reusable field groups that collections can import.

Create or update a reusable fieldset (content/fieldsets/<handle>.yaml).

Number of forms, unread submissions across all forms, submissions per day for the last 14 days (oldest first) and the latest submissions with a one-line summary.

Delete a form definition (submissions are kept).

All submissions of a form as CSV.

A form definition: fields (blocks) and settings.

Forms with their field counts and new submissions.

Create or update a form. fields is a block tree using form/* blocks (form/text, form/email, form/textarea, form/select, form/radio, form/checkboxes, form/checkbox, form/consent, form/file, form/number, form/date, form/tel, form/url, form/hidden) and layout blocks; each field has props label, name, required.

Permanently delete submissions and their files.

Mark a submission as read, spam or archived.

Submissions of a form, newest first.

Delete a global set and its values.

A global set with its fields and values.

Global sets (site-wide values like footer or contact details), with when each last changed.

Create a global set or change its fields.

Set values of a global set (merged into existing values).

The site’s languages with names, URL prefixes, direction and how many entries each has.

Set the site’s languages and the default one. Languages that still have entries cannot be removed.

Recently sent and failed emails.

The transport email is sent with, whether it really delivers (log only does not), sent and failed counts for the last 7 days and the latest emails.

Send a test message with the current email settings.

AI agents (MCP clients) signed in to your account with OAuth, when each was last active, and the latest changes made through MCP as you.

Permanently delete a file and its image variants. Refused while something uses it, unless force is true.

Add a file from a public URL or base64 data. Returns the new media item (use its id in media fields and image blocks).

Browse the media library with search, filters and sorting.

Details for media ids.

Ids and /media/ URLs that point at nothing, records without a file, files without a record, and items nothing uses.

Change name, alt text, caption, folder or focal point (0–100 %).

Delete a menu. Templates that render it show nothing in its place.

A menu with its items; entry items include the linked entry’s title, URI and status.

Menus with their item counts.

Create a menu or replace its items. Items nest through children (up to maxDepth levels). Link pages by entry id so links survive moves; use url for anything else.

Put the key for a paid plugin in place, so the store offers it here.

A store's signed catalog as this site sees it: for each package what can be done with it here, and whether this site has access to it.

Turn a module or plugin off. Its data is kept. Required modules cannot be turned off.

Turn a module or plugin on and run its install/upgrade steps.

Start installing a package from a store. Drive it with packages/job-step until it's done.

One package's listing, its description cleaned on this site.

Where an install stands.

Run the next step of an install. Each step is its own request, so nothing runs into a time limit.

Installed packages with status and their settings namespaces. core marks the modules the admin is made of; required ones cannot be disabled.

What installing a package means here: dependencies in order, capabilities, access. Refused with the reason when it can't work.

Put the previous version of a package back.

Read a store's name and root key fingerprint. Pinned only when confirm repeats that fingerprint. Code from a store runs with full access to this site.

Forget a store. What it installed stays.

The stores this site installs from, each with the fingerprint of its root key.

Run database migrations and install/upgrade steps for active packages.

Disable a plugin and remove its data (and its files when deleteFiles is true).

Turn automatic security updates on or off.

Fetch the signed release list and the store catalog now. Sends nothing but a User-Agent with the version.

Hold automatic security updates back for up to 14 days.

Go back to the release before this one, while it's still on disk.

Start updating the core to a version on offer. Drive it with packages/update-step.

Run the next step of the core update. After the switch, the answer says drive: the new release finishes through /_cms/update/tick.

Switch to a release someone uploaded into runtime/<version>/ by FTP.

Advance automatic security updates by one step.

The core update on offer and everything in its way, updates for store packages, and advisories about what's installed.

Upload a package zip in chunks of base64. The last chunk starts the install. Unsigned packages need a super admin and allowUnsigned.

Entries of the components collection (plus plugin patterns). Synced ones are components: instances update everywhere and take property values. Others are sections copied on insert. Create and change them with entries/create and entries/update in the "components" collection.

Create or replace an entry of the components collection by handle (slug). synced: true makes it a component. Saved as a draft of an existing one unless publish is true.

How many words an entry has and how many minutes it takes to read.

The published entries that take longest to read, and the average reading time.

URL redirects (content/redirects.yaml).

Replace the redirect list. Each: {from: "/old", to: "/new" or "https://…", status: 301|302}.

Roles with their permissions, plus every known permission grouped. Change roles with settings/update (namespace "roles").

On-page checks for search engines and AI answers (title, description, headings, alt text, answer-first, questions, links) with a score.

The on-page checks of seo/analyze across published pages (the 200 changed last; noindex pages left out): average score, how many pages score below 80, the most common issues and the lowest-scoring pages. Refreshed at most every 10 minutes.

The clean Markdown version of a live page that AI crawlers receive.

Fields and values for one settings namespace (secrets masked).

Settings namespaces registered by the core and plugins.

Save values for a settings namespace.

Rebuild the static site (all pages). Work continues in the background; poll site/build-status.

Progress of the static build. Calling it also advances queued work.

Name, URL, timezone, locales and themes. Change them with settings/update (namespace "site").

URL that previews an entry's working copy (drafts included) for signed-in users.

CMS version, PHP, database, packages and pending upgrades.

Entries of the templates collection: block documents that frame pages (header, Page content, footer…). `default` frames anything without its own, `404` renders missing pages. Edit them with entries/update; publishing rebuilds the site.

Create a personal access token. Scopes are ability patterns (e.g. "entries/*", "read" for all read-only abilities, "*" for everything). The token is shown once.

Personal access tokens for the REST API and MCP.

Delete one of your tokens.

For each language, how many entries exist in it (as the original or a translation) out of all entries in content collections, as counts and a share. Counted at most every 10 minutes.

Start the version of an entry in another language, as a draft. translate: true translates the text with AI (when the assistant is set up); otherwise the content is copied for a person to translate.

Every language version of an entry, with status and URL, plus the languages it is missing.

What someone holds beyond their roles (access names the gate on entries compares), who gave it and until when.

Add a user. Without a password, an invitation email with a set-password link is sent.

Remove a user. Their content stays.

The fields every user profile has beyond name and email (content/users.yaml), as stored and resolved.

Replace the fields of user profiles. Values of removed fields stay stored.

One user.

Give someone an access name, optionally until a date. Entries gated on that name open for them.

Email a user a link to set their password.

People with an account on this site: the team (who can open the admin) by default, or the site's visitors.

Safe person identities for authors and user relations, without account details.

The people who signed in most recently (never signed in last), with their role names and how many users there are in all.

Remove an access name from someone, whoever gave it.

Change a user's name, email, roles or profile fields (data).