Smartsheet
Read and write Smartsheet sheets, rows, cells and columns; list workspaces, folders, users and reports via the Smartsheet API 2.0.
About
Smartsheet ships in the w6w first-party pack. It declares 16 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.
- App id
io.w6w.smartsheet- Version
- 0.1.3
- Author
- w6w
- Licence
- MIT
- Categories
- Spreadsheets · Productivity
Overview
Smartsheet runs project and work tracking on a spreadsheet-shaped model of sheets, rows and columns, and this app lets a workflow read and write that data directly. Create a new sheet in a workspace or folder, look up an existing one, and add, update or delete rows and add columns, using the same column-id contract Smartsheet’s own API requires so a write always lands in the field you intended.
Beyond individual sheets, list an account’s workspaces, folders, sheets and saved reports, search a single sheet or search across the whole account, and look up users on the plan, including the connected user’s own profile.
Smartsheet’s API is available only on Business and Enterprise plans, so a workflow using this app needs a token minted on one of those.
Build with Smartsheet
Three routes to the same 16 actions. The Workflow tab is generated from Smartsheet's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
Add Rows
add-rows Insert one or more rows into a sheet. Cells are addressed by column ID — never by column title. Up to 500 rows per call.
Create Sheet
create-sheet Create a sheet in a workspace, in a folder, or from a template. Give a Workspace ID or a Folder ID to choose the destination — with neither, the sheet lands in the deprecated top-level Sheets folder.
Delete Rows
delete-rows Delete rows by id. Deleting a parent row also deletes its child rows, and the response lists every id actually removed.
Get Current User
get-current-user Get the user the connected token belongs to. Needs no permissions beyond a valid token, so it doubles as a connection liveness check.
Get Row
get-row Get one row by id. Add `columns` to Include to get the column list in the same response — cells carry only `columnId`, so without it there is nothing to map ids to titles.
Get Sheet
get-sheet Get one sheet with its columns and rows. The Include and Exclude flags materially change the response shape — read their hints before relying on a field being present.
List Columns
list-columns List a sheet's columns. Use this to resolve column titles to the column IDs that every cell read and write is keyed by.
List Container Children
list-container-children List the sheets, reports, dashboards, folders and templates inside a workspace or a folder. This is the supported way to enumerate folders — there is no standalone list-folders endpoint.
List Reports
list-reports List reports the connected user can access, by id, name, access level and summary-report flag. Reports are read-only here — their columns are virtual, not real sheet columns.
List Sheets
list-sheets List every sheet the connected user can access, as abbreviated Sheet objects (id, name, access level, permalink). Use Get Sheet to read columns and rows.
List Users
list-users List users in the organization account. Requires admin rights — a non-admin token gets a reduced response or an error, which is not a sign of a broken connection.
List Workspaces
list-workspaces List workspaces the connected user can access. Token-paged via `lastKey` rather than page/pageSize, and metadata only — use List Container Children for the contents.
Search
search Search every sheet the connected user can access. Returns `results` (not `data`), and is index-backed — recent writes may not be discoverable yet.
Search Sheet
search-sheet Search within a single sheet. Returns abbreviated row objects under `results` — use Get Row for the full cell set.
Update Rows
update-rows Update cell values, lock state, expansion or position on existing rows. Cells are addressed by column ID. Send an empty string to clear a cell; omit the cell to leave it alone.
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying Smartsheet's real ids.
{
"manifestVersion": "2",
"name": "smartsheet-example",
"steps": [
{
"id": "add-column",
"uses": {
"app": "io.w6w.smartsheet",
"action": "add-column",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"sheetId": "<sheetId>",
"title": "<title>",
"type": "<type>"
}
}
]
}Here are some of the things you can do
-
Add Column
performadd-column -
Add Rows
performadd-rows -
Create Sheet
performcreate-sheet -
Get Current User
readget-current-user -
Get Row
readget-row
+11 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for Smartsheet, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to Smartsheet. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "add-rows",
payload: {
sheetId: "<value>",
// cells: "<value>",
// rows: "<value>",
// location: "<value>",
// anchorRowId: "<value>",
// allowPartialSuccess: "<value>",
// overrideValidation: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value);npm install -g @w6w/cliw6w run conn_YOUR_CONNECTION_ID --action add-rows --payload '{"sheetId":"<value>"}'Give an AI agent Smartsheet — without giving it Smartsheet's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.smartsheet#add-column",
"input": {
"sheetId": "<sheetId>",
"title": "<title>",
"type": "<type>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's Smartsheet connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
What the agent gets
Credentials it can't read
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
A tool surface scoped to the caller
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
A durable workflow in one call
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Health-aware discovery
Smartsheet's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. Smartsheet itself is MIT, and the runtime that executes it is source-available (FSL).
Health checks
Smartsheet declares its own checks, so its health is a property of the app rather than something the host guesses at.
Smartsheet platform status
Atlassian Statuspage rollup for status.smartsheet.com, with per-component detail. Unauthenticated and unsigned.