Reference

Everything below is generated from the kernel’s command registry. It is not a description of the API — it is the API, projected: the same registry produces the HTTP routes, the CLI table, the MCP tool list and the SDK’s types, so a page here cannot disagree with the thing it documents.

• 184 commands across 26 domains — every mutation in Forge is one of them, and 10 of them are platform commands on the control face.
• 31 public reads — the anonymous face a storefront calls.
• 60 operator reads — the internal face, gated by scope.
• 10 control reads — the platform face.

One name, four surfaces

A command’s name is its address everywhere:

POST /v1/commands/catalog.product.create     # API
forge catalog.product.create --input '{…}'   # CLI
catalog.product.create                       # MCP tool
client.call('catalog.product.create', {…})   # SDK

There is no translation table, because there is no translation.

The anonymous faces

Commands whose scope is public — building a cart, placing an order, a shopper logging in, starting a payment — are not on /v1/commands/*. That path is the tenant face and requires a credential.

They are served instead by several anonymous faces, each mounting an explicit list of commands under its own prefix: /v1/cart, /v1/checkout, /v1/customer, /v1/operator and /v1/payment. None takes a credential; the store travels in the x-forge-store header, and possession of the relevant id — a cart, a session — is the capability, the same fence a browser lives behind.

⚠️ A few public commands are on no external face at all, on purpose. The ones that move money are reached only by the kernel itself, acting on a verified provider verdict: a caller that could mark its own order paid is the one hole this design will not have.

Those lists live at the edge and are not part of the registry — which is why a command’s own page names the FACE rather than a path. This reference publishes what the registry knows, and stops there.

How to read a page

Each command page carries its scope, whether it is a platform command, the events it emits (or the reason it emits none), its input schema and its result schema. Each read page carries its face, its params and its result. The errors are the same six on every command; the scopes are the names a credential can carry.