Declare what a member site uses

​

Know how a declaration works

• A declaration limits the owner’s code. Each entry is a scope, such as tasks: write. Once the site has published a declaration, it narrows what the owner’s code can reach to the scopes it lists. Fluid refuses a call whose scope the file lacks, so a call you forgot to declare fails for you first.
• A site with no declaration behaves as it did before. The owner of a member’s site can call every route fluid.fetch allows. Every other viewer gets no data from the site’s scripts, with or without a declaration.
• A declaration only narrows. The routes that no site can reach, and the routes a site can read but not change, stay that way for every declaration. A guest gets nothing either way.
• Lint checks your scripts against it. fluid member-site lint checks each fluid.fetch(path, { method }) call against the scope of that path. A site with no file isn’t checked this way.
• A declaration is a draft until you publish. Fluid publishes the declaration together with the site’s settings. A site’s access field reports the declaration the site last published, never the draft.
• Only member-owned sites have one. A company site takes no declaration. The file API refuses config/access.json on a company site, and a company site never lists it.
• Nobody else gains anything. Sharing a site, sharing it again and a site’s declaration never give a share holder, an admin or a visitor a scope. Only the signed-in owner of a member-owned site gets data from the site’s scripts. See Know who gets data.
• Narrowing is immediate. A take-down, an owner who is no longer active and a publish that drops a scope all refuse the next call. Fluid checks the site on every request.

​

Write a declaration

{
  "uses": [
    "profile: read",
    "tasks: read",
    "tasks: write"
  ]
}

await fluid.fetch("/api/member/v2026-10/me");
await fluid.fetch("/api/member/v2026-10/tasks");
await fluid.fetch("/api/member/v2026-10/tasks/1/complete", { method: "POST" });

• A scope is <family>: read or <family>: write, such as tasks: read. write doesn’t include read, so a site that does both declares both.
• The file is at most 4 KiB and lists at most 64 entries, with no entry twice.
• Fluid refuses a file with an unknown key, a repeated key, an entry that isn’t a string, an unknown field, family or mode, or session: read.
• Don’t declare session: read. Lint reports it as an error.
• { "uses": [] } declares nothing. That is not the same as having no file. With no file, the site behaves as it did before. With an empty list, the site asks for nothing, so its scripts reach no data. Lint doesn’t check calls when there is no file, and it warns on every call when the list is empty.
• A file written earlier may still list entries such as member.email. Fluid accepts them so that file stays valid, but your scripts don’t need them. To read the member in a script, declare profile: read and call fluid.fetch("/api/member/v2026-10/me").
• A field entry grants no call. A declaration of member fields alone lists no scope, so the site’s scripts reach no data. The one field Fluid reads is member.full_name. The session answer, GET /api/member-storefront/session, carries the owner’s display_name only for a site with no declaration or one that lists member.full_name. Otherwise it is blank.

​

Declare scopes

• The mode comes from the request. A GET request needs read. Any other method that Fluid forwards needs write.
• The family comes from the route. Fluid takes it from the route that serves the request, so a request can’t borrow another family’s scope by changing its path.
• A route with no family is refused. A site that has a declaration can’t call a route that appears in no family above.
• Some routes are read only. addresses and subscriptions are read only: a write is refused for every declaration. Push devices under notifications are read only too.
• session: read is never declared. Every bridged call needs the viewer’s session first, so Fluid grants session: read to any declaration that holds at least one other scope. A declaration with no scope, member fields alone included, gets no session. The owner’s frame gets no handshake and a blank session, so the site’s scripts reach no data.
• A declaration never opens a route that the member API keeps off the browser. Saved payment methods, the member’s companies, the member API’s Exigo routes, and site management and shares stay refused for every site.

​

Publish, change and remove a declaration

• Publish. Publishing the site publishes the declaration together with the settings.
• Change. Edit the file, push it and publish again.
• Remove. Delete config/access.json and push. That clears the draft declaration only: the published one stays until you publish the site. Publishing a site with no draft declaration removes the one it had published, and the site returns to the behavior it had with no declaration.
• Copy. A member’s copy of a member’s site starts with the original’s published declaration as its own draft. A company admin’s copy of a member’s site starts with none, because a company site takes no declaration. After that, changes to either site never change the other.
• Company sites. The file API refuses the path on a company site, and fluid member-site push leaves it alone.

​

Check a declaration

• pull writes it. pull writes config/access.json into the folder when the site has a draft declaration. When the site no longer has one, pull deletes your local copy if you haven’t edited it since the last pull or push. A copy you edited stays, unless you pull with --force.
• push sends it. push sends the file with the other site files, and a push with no edit sends nothing for it. push refuses an invalid declaration before it sends any request.

• An invalid file is an error. Lint reports each problem the file API would refuse: not valid JSON, a key other than uses or a repeated key, an entry that isn’t a string or appears twice, an unknown field, family or mode, session: read, more than 64 entries, and a file over 4 KiB.
• A fluid.fetch call the declaration lacks is a warning. When the file is valid, lint checks each fluid.fetch(path, { method }) call in a script against the scope of that path. It warns when the declaration doesn’t list the scope, such as a PATCH to /api/member/v2026-10/me without profile: write. It also warns when the route is one a site can never reach, and when it can’t read the call, for example because the path or method comes from a variable.
• A Liquid file that reads member.<field> is a warning. Lint warns whatever the declaration holds, because member data is leaving member site Liquid. Read it in a script with fluid.fetch("/api/member/v2026-10/me"), which needs profile: read.

​

See what a site declares

​

Handle a refusal

​

Fix a declaration