.ctx Overview
.ctx is the Context API — the scoped read/write surface available inside an Ambassador (a Host
serverless function). Unlike the CLI and MCP, an Ambassador doesn't use an API key: .ctx is
already authenticated as a server-side context scoped to that app.
From an Ambassador
export default async function handler(req, ctx) {
const bucket = ctx.storage.bucket('customer-uploads')
await bucket.put('report.pdf', bytes, { contentType: 'application/pdf' })
}
ctx.storage is one namespace; see Host Storage for the full API. Other
resources follow the same shape: a namespaced object scoped to what your app has been granted.
Deny by default
An action not explicitly allowed is not reachable through .ctx, whatever scope your app holds.
This isn't a small allowlist — as of this writing it's 538 allowed actions across 30
resources, generated from every commander-* edge function's actions, classified deliberately.
This is a point-in-time snapshot (regenerated internally as the platform grows) — treat the exact
counts as "roughly this size," not a guarantee.
What's reachable today (by resource, most actions first)
journey (57), calendar (39), sheet (31), connection (26), contact (26), email (26),
rush (25), meeting (24), inbox (24), form (23), task (23), channel (21), call (20),
workspace (18), message (18), document (14), role (13), domain (12), file (12),
taskboard (12), spark (10), table (10), framework (10), layer (8), assessment (7),
team (7), automation (6), user (6), goal (5), markdown (5) — each split further into
read/write/delete actions.
Why something might be denied
| Denied because... | Meaning |
|---|---|
| Not in the entity registry | The resource hasn't been classified for .ctx reachability yet |
| Verb not derivable | The action's name doesn't map cleanly to read/write/delete |
| Never-reachable | Deliberately excluded — billing, API-key minting, membership changes, inbound webhooks |
| Needs-human | Live, consent-sensitive, or hard-to-undo — admitting someone to a call, starting a mail send, an assessment answered on someone's behalf |
| Internal | Service-secret-only, cron-triggered, or UI-only state — not a real operation an app should call |
If an action your app needs is denied, that's very likely deliberate (see the categories above) — contact support@waymakerone.com if you think a resource should be reachable and isn't.
Next steps
- Host Storage — the most fully documented
.ctxnamespace today - Authentication