GoliathDevelopersGet an API key
Reference/Spacesgenerated from the gateway manifest

setSpaceAccessMode

RESTRICTED closes a folder or file.

POST/api/v1/callWRITEidempotent · 24 hruns as the key's owner
View as Markdown

RESTRICTED closes a folder or file (and everything in it) to all but its owner and the people it is shared with; INHERIT opens it back to the audience of the folder it is in, which can WIDEN who sees it. Needs MANAGER. Requires the user's explicit approval.

curl https://server.goliathdata.com/api/v1/call \
  -H "Authorization: Bearer $GOLIATH_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "operationId": "setSpaceAccessMode",
    "variables": {
      "itemId": "<itemId>",
      "accessMode": "INHERIT"
    }
  }'
import { GoliathClient } from '@goliath-data/sdk'

const goliath = new GoliathClient({
  apiKey: process.env.GOLIATH_API_KEY!,
  baseUrl: 'https://server.goliathdata.com',
})

// Enum values as strings: the SDK's enum types aren't exported yet, so assert to the method's variables type.
const variables = {
  itemId: '<itemId>',
  accessMode: 'INHERIT'
} as Parameters<typeof goliath.spaces.setSpaceAccessMode>[0]

const result = await goliath.spaces.setSpaceAccessMode(variables, { idempotencyKey: crypto.randomUUID() })
const res = await fetch('https://server.goliathdata.com/api/v1/call', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.GOLIATH_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({
    operationId: 'setSpaceAccessMode',
    variables: {
      itemId: '<itemId>',
      accessMode: 'INHERIT'
    }
  }),
})
const { data, errors } = await res.json()

Variables

The example sends only what the schema requires. Some operations also need one of several optional variables (one filter or another, say); the description above says which.

itemIdID!required
accessModeSpaceAccessMode!required
INHERITRESTRICTED

Response

What comes back under data: a list shows as one entry, and a value as its type.

response shape
{
  "data": {
    "spacesMutation": {
      "setAccessMode": {
        "id": "<ID>",
        "spaceId": "<ID>",
        "spaceName": "…",
        "parentId": "<ID>",
        "kind": "FOLDER",
        "name": "…",
        "description": "…",
        "fileType": "…",
        "sizeBytes": 0,
        "accessMode": "INHERIT",
        "systemLocked": true,
        "viewerRole": "VIEWER",
        "abilities": {
          "addChildren": true,
          "edit": true,
          "move": true,
          "trash": true,
          "share": true
        },
        "owner": {
          "id": "<ID>",
          "name": "…"
        },
        "createdBy": {
          "kind": "PERSON",
          "label": "…"
        },
        "childCount": 0,
        "shareCount": 0,
        "currentVersion": {
          "id": "<ID>",
          "versionNumber": 0
        },
        "path": [
          {
            "id": "<ID>",
            "name": "…"
          }
        ],
        "updatedAt": "2026-01-01T00:00:00.000Z",
        "trashedAt": "2026-01-01T00:00:00.000Z"
      }
    }
  }
}

Errors

400unknown_variable

A variable the operation does not declare. A typo is refused rather than silently dropped.

401unauthorized

No bearer header, or the key is invalid or revoked.

403insufficient_scope

The key lacks the scope the operation requires.

403forbidden

A referenced record does not exist, was deleted, or is outside your organization. The gateway cannot tell those apart.

409idempotency_conflict

A request with this Idempotency-Key is still in flight.

Idempotency

Send an Idempotency-Key of 1 to 255 characters. A finished request retried with the same key replays its stored response, marked Idempotency-Replayed: true; one still in flight returns 409 idempotency_conflict. Keys expire after 24 hours. Write without fear →

READlistSpaceRootsREADlistSpaceFolderREADgetSpaceItemREADsearchSpaceItemsREADgetSpaceTextContentREADgetSpaceTextLines