First-party app
Document360

Document360

Document360 knowledge base: projects, workspaces, categories, articles, drive, team accounts and readers.

stable Content ManagementDocuments & Files

About

Document360 ships in the w6w first-party pack. It declares 37 actions, 3 health checks, and the host runs its code in a sandbox that never sees the credential.

App id
io.w6w.document360
Version
0.1.0
Author
w6w
Licence
MIT
Categories
Content Management · Documents & Files

Overview

Document360 is a knowledge-base platform for product documentation, help centres and internal wikis. This app drives its v3 Customer API from a workflow: list projects and workspaces, browse the category tree, read, create, update, publish, unpublish, fork, archive and delete articles, manage categories, search a workspace, work with the Drive (folders and files), and read team accounts, groups and readers.

Authentication is a single v3 API key (d360_sk_…) sent in the X-API-Key header. The key carries its own portal role, content role and content-access scope, so what a workflow can do follows what that key was granted. Document360 hosts each project in one data centre, so the connection asks for the region (Europe, United States or Canada) and optionally a default project id; if the key can see exactly one project, the app fills the project in for you.

The v3 API is the current one. The older v1 and v2 APIs, which authenticate with an api_token header, are not covered.

Build with Document360

Three routes to the same 37 actions. The Workflow tab is generated from Document360's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.

Archive Article

article-archive

Archive an article language version: it becomes read-only and drops out of publish and search surfaces until restored.

Create Article

article-create

Create an article in draft status. Publish it with Article: Publish.

Delete Article

article-delete

Permanently delete an article and all its versions. Irreversible; consider Article: Archive or Unpublish instead.

Fork Article Version

article-fork

Create a new draft version copied from an existing one (the published version by default), so edits do not touch the live article.

Get Article

article-get

Fetch an article's latest version (draft or published) with raw content and rendered HTML.

Publish Article

article-publish

Publish a draft version of an article, superseding any previously published version.

Get Article Settings

article-settings-get

Read an article's SEO metadata, visibility flags, tags, related articles and custom-field values.

Restore Archived Article

article-unarchive

Restore an archived article language version so it can be edited again.

Unpublish Article

article-unpublish

Revert a published article version to draft. The content is preserved.

Update Article

article-update

Partially update an article: only the fields you set change. Also moves it (categoryId) or reorders it (order).

List Article Versions

article-version-list

List every version of an article (draft and published) with its number, status and author.

Create Category

category-create

Create a category in a workspace: a folder, a page, or an index category, optionally nested under a parent.

Delete Category

category-delete

Permanently delete a category with every version and child article. Irreversible.

Get Category

category-get

Fetch a category's metadata with its nested articles and child categories.

Publish Category

category-publish

Publish a draft version of a category (page category), making it visible to readers.

Update Category

category-update

Partially update a category: rename, reorder, move under another parent, hide, or change its icon.

Get Document by URL

document-get-by-url

Look up an article or category by its relative URL path (for example /getting-started).

Get Drive File

drive-file-get

Fetch a Drive file's metadata: URL, type, dimensions, tags and alternative text. The folder id must be the folder that currently holds the file.

Create Drive Folder

drive-folder-create

Create a Drive folder at the root or under a parent folder.

Get Drive Folder

drive-folder-get

Fetch a Drive folder with a page of the files inside it. Sub-folders are always returned in full.

List Drive Folders

drive-folder-list

List all Drive folders as a tree (each folder carries sub_folders and an item count).

Search Drive

drive-search

Full-text search across Drive file names, with optional filters for uploader, date range, tags and images only.

List Labels

label-list

List the project's labels, optionally filtered by a name substring.

List Languages

language-list

List the languages configured for a workspace (the default workspace when none is given).

Get Project

project-get

Fetch one project: name, description, sub-domain and status (0 active, 1 inactive).

List Projects

project-list

List the projects (knowledge bases) the API key can access. Use it to find the project id.

List Readers

reader-list

List the readers of a private or mixed knowledge base, optionally filtered by email.

List Tags

tag-list

List the project's tags, optionally filtered by a name substring.

Get Team Account

user-get

Fetch one team account with its portal role, content roles and group memberships.

List Team Groups

user-group-list

List the project's team-account groups (id, title, description).

List Team Accounts

user-list

List the project's team accounts, optionally filtered by name or email.

List Workflow Statuses

workflow-status-list

List the workflow statuses configured for the project. Empty when no workflow is set up.

List Workspace Articles

workspace-article-list

List article summaries in a workspace (id, title, category, status, versions, content hash). Fetch the body with Article: Get.

List Workspace Categories

workspace-category-list

List a workspace's categories as a tree (each node carries child_categories). Articles are excluded; use Workspace: List Articles.

Get Workspace

workspace-get

Fetch one workspace, including its default language code and RTL flag.

List Workspaces

workspace-list

List a project's workspaces (versions of its content). Workspace ids are needed by article and category creation.

Search Workspace

workspace-search

Keyword search across the published, visible articles of a workspace.

A workflow step names the app and the action, and the editor fills in the connection when you pick one. This is the Step shape from the workflow spec, carrying Document360's real ids.

{
  "manifestVersion": "2",
  "name": "document360-example",
  "steps": [
    {
      "id": "article-create",
      "uses": {
        "app": "io.w6w.document360",
        "action": "article-create",
        "connection": "conn_YOUR_CONNECTION_ID"
      },
      "with": {
        "workspaceId": "<workspaceId>",
        "categoryId": "<categoryId>",
        "title": "<title>"
      }
    }
  ]
}

Here are some of the things you can do

  • Create Article

    perform
    article-create
  • Fork Article Version

    perform
    article-fork
  • Get Article

    read
    article-get
  • Publish Article

    perform
    article-publish
  • Get Article Settings

    read
    article-settings-get

+32 more actions available

Every app-specific value here is a blank you have to fill in. An app action is reached through the connection that authenticates it, so the address is a connection id, not the app id — and connections belong to your account, so a public page cannot know yours. Create one for Document360, then fill in the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the parameters that action declares. The call itself is real — the shape is transcribed from the studio's own snippet builder, which prints the same kind of blanks — but nothing in it is specific to Document360. The Workflow tab is where this app's real ids are.

Install
npm install @w6w/sdk
yarn add @w6w/sdk
pnpm add @w6w/sdk
deno add npm:@w6w/sdk
Code
import { W6wClient, isActionRun } from "@w6w/sdk";

// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();

const envelope = await client.run({
  urn: "conn_YOUR_CONNECTION_ID",
  action: "article-create",
  payload: {
    // projectId: "<value>",
    workspaceId: "<value>",
    categoryId: "<value>",
    title: "<value>",
    // content: "<value>",
    // contentType: "<value>",
    // slug: "<value>",
    // order: "<value>",
  },
});

if (isActionRun(envelope)) console.log(envelope.value);
Install the CLI
npm install -g @w6w/cli
CLI
w6w run conn_YOUR_CONNECTION_ID --action article-create --payload '{"workspaceId":"<value>","categoryId":"<value>","title":"<value>"}'

Give an AI agent Document360 — without giving it Document360's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.

One tool call
{
  "name": "w6w_invoke",
  "arguments": {
    "ref": "app:io.w6w.document360#article-create",
    "input": {
      "workspaceId": "<workspaceId>",
      "categoryId": "<categoryId>",
      "title": "<title>"
    }
  }
}

Every tool names its target with a single ref. The app: form above doesn't name a connection at all — the host resolves which of the caller's Document360 connections to sign with, and refuses rather than guesses when the answer is ambiguous.

What the agent gets

Credentials it can't read

The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.

A tool surface scoped to the caller

Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.

A durable workflow in one call

Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.

Health-aware discovery

Document360's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.

The MCP surface is part of the hosted platform. Document360 itself is MIT, and the runtime that executes it is source-available (FSL).

Request MCP access

Health checks

Document360 declares its own checks, so its health is a property of the app rather than something the host guesses at.

service

Document360 platform status

dependency

API reachable

Unauthenticated GET /v3/projects on this connection's data center. Document360's 401 (empty body, www-authenticate: Bearer) or a problem+json answer proves the API Hub is serving. Credential validity is the derived `auth:*` check's job.

quota

Read-request headroom

Remaining share of the per-minute read allowance, from X-RateLimit headers on GET /v3/projects.