Coming soon · Contract draft

Portals & Stakeholders

Planned

A two-sided portal contract separating agency administration from capability-URL participant actions and stakeholder identity.

Reviewable specification — not callable

Documentation-first contract draft. The proposed additions on this page are not callable or available yet. Paths, payloads, scopes, names, and examples are intentionally concrete so customers can review the intended contract before and during implementation.

Canonical owner

Portal, participant, deliverable, decision, and acknowledgement services

Contract posture

P2 · Documentation first · implementation follows approval

Contract metadata

Draft version

0.2 review draft

Review owner

Commercial/Knowledge + Developer Platform

Last reviewed

July 14, 2026

Target wave

Wave 4–6 · Customer collaboration

Contract dependencies

• Canonical identity and provider mapping policy
• Field-level visibility rules
• Transactional event outbox

What this unlocks

Configure stakeholder portals

Read a stable domain model for portals & stakeholders without depending on GUI routes or database shapes.

Publish governed deliverables

Create a reviewable proposal and apply only the bounded commands the canonical owner permits.

Collect decisions and acknowledgements

React to durable lifecycle facts and connect external systems with explicit direction and provenance.

Lifecycle and invariants

Portals & Stakeholders exposes a bounded lifecycle with explicit commands and named authority at every transition.

draftinvitingactivesuspendedarchived

From	To	Command	Authority
draft	inviting	Invite participants	Portal and participant services
inviting	active	Activate portal	Portal and participant services
active	suspended	Suspend portal	Portal and participant services
suspended	archived	Archive portal	Portal and participant services

Lifecycle invariants

• Share tokens are never listable resource IDs.
• Every customer action binds to a participant identity or audience capability.

Authority boundaries

The interfaces expose canonical capabilities; they do not become a second owner of domain rules or state.

DigitalStack owns

• Portal configuration and participant identity
• Deliverable publication and acknowledgement
• Customer decision and message lifecycle

Explicitly not building

• Share tokens exposed by list APIs
• Agents impersonating customers
• Portal grouping mutating delivery ownership

Surface decisions

Deliberate additions, retained boundaries, and removals from the proposed external contract.

add

Agency configuration plus participant-safe deliverable, decision, message, and acknowledgement actions

The two sides need different principals and payloads.

keep

Audience-bound capability URLs for external participants

They are safer than pretending every participant has an ordinary API identity.

remove

Share-token listing, agent impersonation, and portal grouping as delivery authority

These violate token secrecy, attribution, and ownership boundaries.

Interface plan

REST API

Planned

Versioned portals & stakeholders resources, commands, idempotency, and operation status.

Reads + explicit commands

GraphQL

Planned

Composable Portal reads with mutations delegated to the same canonical domain service.

Composable reads + bounded delegated mutations

MCP / Agent API

Planned

Bounded read, draft, and confirmed apply tools with evidence and audit attribution.

Read + proposal/confirmed commands only

Webhooks

Planned

Past-tense deliverable lifecycle facts with minimal payloads.

Past-tense durable facts only

Connected Apps

Planned

Email / Slack / Teams / CRM plus consumer clients, with declared direction and authority.

Declared direction and field authority required

Cross-interface parity

Each surface delegates to the named canonical owner; a blank surface is an intentional denial of authority, not missing documentation.

Capability	REST	GraphQL	MCP	Webhook	Canonical owner
Primary read	GET /portals	portal(id: ID!): Portal	get_portals_stakeholders	—	Portal, participant, deliverable, decision, and acknowledgement services
Primary command	POST /portals	draftPortalChange(input: DraftPortalChangeInput!): PortalChangeProposal!	draft_portals_stakeholders_change	deliverable.created	Portal, participant, deliverable, decision, and acknowledgement services

Proposed scopes

Proposed scopes are not grantable yet.

portals:readplanned scope

Read governed portals & stakeholders resources.

portals:writeplanned scope

Create and edit bounded portals & stakeholders fields.

portals:operateplanned scope

Run explicit portals & stakeholders lifecycle commands.

Behavioral contract

Cross-cutting rules every implementation and interface must satisfy.

Canonical delegation

Every interface delegates to Portal, participant, deliverable, decision, and acknowledgement services; no resolver, gateway, worker, or connector reimplements domain rules.

Least-privilege principals

Scopes are evaluated with tenant, role, field-visibility, and principal-type constraints before data is read or changed.

Safe writes

Mutations use explicit confirmation where required, optimistic concurrency, idempotency, and durable actor attribution.

Transactional facts

Webhook facts are emitted from the canonical commit path, versioned, minimal, and safe to redeliver.

Declared provider authority

Every Connected App declares direction, field authority, provenance, and conflict behavior before activation.

REST API

Proposed endpoints

Planned

GET/api/v1/portals

List portals & stakeholders

Return an authorized, paginated collection with stable filters and provenance.

portals:read

POST/api/v1/portalsconfirmation

Create Portal

Create one canonical resource with idempotency and actor attribution.

portals:write

GET/api/v1/portals/{id}

Retrieve Portal

Return canonical detail, lifecycle state, permissions, and allowed actions.

portals:read

PATCH/api/v1/portals/{id}confirmation

Update Portal

Update bounded editable fields using optimistic versioning.

portals:write

POST/api/v1/portals/{id}/publishconfirmation

publish Portal

Run one explicit domain command after validation and authorization.

portals:operate

publish a Portal

Planned request

curl --request POST \
+  --url https://www.digitalstack360.com/api/v1/portals/deliverable_123/publish \
+  --header "Authorization: Bearer $DSTACK_API_KEY" \
+  --header "Content-Type: application/json" \
+  --header "Idempotency-Key: portals-stakeholders-publish-v2" \
+  --data '{
    "expected_version": 2,
    "reason": "Confirmed through the reviewed integration workflow"
  }'

Planned response

{
  "data": {
    "id": "deliverable_123",
    "status": "published",
    "version": 3,
    "operation_id": "op_01k4..."
  }
}

GraphQL

Proposed graph

Planned

Types

Portal

PortalConnection

PortalChangeProposal

Operation

Queries

portal(id: ID!): Portal

portalList(filter: PortalFilter, pagination: PaginationInput): PortalConnection!

Mutations

draftPortalChange(input: DraftPortalChangeInput!): PortalChangeProposal!

applyPortalChange(input: ApplyPortalChangeInput!): PortalPayload!

Planned GraphQL query

query PortalDetail($id: ID!) {
  portal(id: $id) {
    id
    status
    version
    updatedAt
    allowedActions { id label requiresConfirmation }
    source { kind externalId }
  }
}

MCP / Agent API

Proposed tools

Planned

Get Portals & Stakeholders

get_portals_stakeholders

Planned

Read the authorized portals & stakeholders state, provenance, and allowed actions.

Scope: portals:read
Input: Resource id or a bounded filter.
Output: Canonical detail with source provenance and allowed actions.
Write boundary: Read only.

Draft Portals & Stakeholders change

draft_portals_stakeholders_change

Planned

Build a reviewable proposal from explicit user intent and DigitalStack evidence.

Scope: portals:write
Input: Target, requested outcome, expected version, and optional evidence references.
Output: A persisted proposal, validation results, and conflicts.
Write boundary: Creates a proposal; it does not mutate canonical state.

Apply Portals & Stakeholders change

apply_portals_stakeholders_change

Planned

Apply a reviewed proposal through the canonical service.

Scope: portals:operate
Input: Proposal id, expected version, idempotency key, and explicit confirmation.
Output: Updated canonical resource and audit reference.
Write boundary: Confirmation, optimistic versioning, and idempotency required.

Planned agent workflow

User: Review the proposed portals & stakeholders change and help me apply it.

1. Call get_portals_stakeholders to inspect current state, provenance, and allowed actions.
2. Call draft_portals_stakeholders_change to create a proposal without changing canonical state.
3. Show validation results, conflicts, and the exact command to the user.
4. After explicit confirmation, call apply_portals_stakeholders_change with the proposal version.

Never infer authority from access to the MCP client.

Webhooks

Proposed event catalog

Planned

Event types

deliverable.createdplanned event

A canonical Portal was created.

payload: deliverable_id, status, created_at

deliverable.updatedplanned event

Governed Portal fields changed.

payload: deliverable_id, changed_fields, version, occurred_at

deliverable.publishedplanned event

The publish command completed.

payload: deliverable_id, prior_status, status, occurred_at

Planned event example

{
  "event_id": "evt_01k4...",
  "type": "deliverable.published",
  "event_version": 1,
  "occurred_at": "2026-07-16T14:22:04Z",
  "workspace_id": "ws_abc123",
  "resource": {
    "type": "deliverable",
    "id": "deliverable_123"
  },
  "actor": {
    "id": "user_123"
  },
  "payload": {
    "deliverable_id": "deliverable_123",
    "prior_status": "draft",
    "status": "published"
  },
  "source": null
}

Connected Apps

Proposed connection roles

Planned

Claude / ChatGPT / IDE clients

Consumer application

Read, explain, and submit bounded portals & stakeholders proposals through MCP.

Authority: Client access never implies domain approval or unrestricted mutation authority.

Email / Slack / Teams / CRM

Action sink

Invite stakeholders and deliver scoped portal actions.

Authority: External identities receive only audience-bound capabilities and attributable actions.

Open contract decisions

Resolve before implementation approval

• Which participant actions should be exchangeable for durable OAuth identities?

Proof obligations

Must remain true	Failure indicator
Portal, participant, deliverable, decision, and acknowledgement services remains the singular canonical owner.	An interface or connector persists a second authoritative lifecycle state.
Draft and apply remain separate actions.	An agent or integration silently converts inferred intent into a canonical mutation.
Every write is attributable, versioned, and idempotent.	A retry duplicates work or stale state overwrites a newer human decision.
Connected App direction and field authority are explicit.	Provider data silently becomes canonical or conflicts are resolved without policy.