Runtime and permissions

A d0 dashboard contains manifest.json and local web assets. It runs in a WebView and uses window.gatetrix for supported data capabilities.

A public-data manifest

This example matches the permissions used by the Hacker News sample. Place an index.html file beside the manifest.

{
  "manifest_version": 1,
  "id": "hacker-news-pulse",
  "name": "Hacker News Pulse",
  "version": "1.0.0",
  "description": "Read the public Hacker News front page.",
  "entrypoint": "index.html",
  "permissions": {
    "network": [
      {
        "host": "hn.algolia.com",
        "path_prefixes": ["/api/v1/"]
      }
    ],
    "gatetrix": {
      "tools": [],
      "connectors": []
    }
  }
}

Use a distinct stable id for your own dashboard. Bundle scripts and styles locally. The dashboard cannot use Node APIs, launch a shell, access arbitrary files, load remote scripts, or make arbitrary direct network requests.

JavaScript bridge

These calls run inside a dashboard after the corresponding capabilities have been declared and the version trusted:

const response = await window.gatetrix.fetch(
  "https://hn.algolia.com/api/v1/search?tags=front_page"
);
if (response.status < 200 || response.status >= 300) {
  throw new Error(`Request failed: HTTP ${response.status}`);
}
const data = JSON.parse(response.body);

For a dashboard connected to Access, discover its available tools and call a declared tool using its current input schema:

const tools = await window.gatetrix.listTools();
// const result = await window.gatetrix.callTool(toolName, input);

Public requests are bounded HTTPS GET requests. For connected services, use Access and declare the specific tools or connector operations. The tool list does not grant new permissions.

Local storage

Add a storage declaration inside permissions when the dashboard needs saved settings or records. This is a manifest fragment:

{
  "storage": {
    "preferences": true,
    "collections": ["daily-metrics"],
    "max_bytes": 10000000
  }
}

Then use the bridge:

await window.gatetrix.preferences.set("view", "weekly");
const view = await window.gatetrix.preferences.get("view");

await window.gatetrix.storage.put(
  "daily-metrics", "2026-10-01", { requests: 42 }
);
const records = await window.gatetrix.storage.scan("daily-metrics", {
  start_key: "2026-10-01",
  end_key: "2026-10-31",
  limit: 31
});

Storage belongs to the stable dashboard ID and declared collections. It is not a secret store. Keep API keys and tokens out of preferences and records.

Trust and failures

Changes to dashboard files require review of the new version before it can use runtime data capabilities. Builder access does not grant trust. Handle loading, empty, denied, and failed states visibly. For a failed or uncertain write through Access, inspect the result or approval request before retrying. Use Runtime Audit to investigate host calls associated with a version.

Get started

Build dashboards

Runtime and permissions

A public-data manifest

JavaScript bridge

Local storage

Trust and failures

​A public-data manifest

​JavaScript bridge

​Local storage

​Trust and failures

A public-data manifest

JavaScript bridge

Local storage

Trust and failures