> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gatetrix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Runtime and permissions

> Define a dashboard manifest and use d0's JavaScript bridge for public requests, Access tools, and app-scoped storage.

A d0 dashboard contains `manifest.json` and local web assets. It runs in a WebView
and uses `window.gatetrix` for supported data capabilities.

## A public-data manifest

This example matches the permissions used by the Hacker News sample. Place an
`index.html` file beside the manifest.

```json theme={null}
{
  "manifest_version": 1,
  "id": "hacker-news-pulse",
  "name": "Hacker News Pulse",
  "version": "1.0.0",
  "description": "Read the public Hacker News front page.",
  "entrypoint": "index.html",
  "permissions": {
    "network": [
      {
        "host": "hn.algolia.com",
        "path_prefixes": ["/api/v1/"]
      }
    ],
    "gatetrix": {
      "tools": [],
      "connectors": []
    }
  }
}
```

Use a distinct stable `id` for your own dashboard. Bundle scripts and styles
locally. The dashboard cannot use Node APIs, launch a shell, access arbitrary
files, load remote scripts, or make arbitrary direct network requests.

## JavaScript bridge

These calls run inside a dashboard after the corresponding capabilities have
been declared and the version trusted:

```javascript theme={null}
const response = await window.gatetrix.fetch(
  "https://hn.algolia.com/api/v1/search?tags=front_page"
);
if (response.status < 200 || response.status >= 300) {
  throw new Error(`Request failed: HTTP ${response.status}`);
}
const data = JSON.parse(response.body);
```

For a dashboard connected to Access, discover its available tools and call a
declared tool using its current input schema:

```javascript theme={null}
const tools = await window.gatetrix.listTools();
// const result = await window.gatetrix.callTool(toolName, input);
```

Public requests are bounded HTTPS GET requests. For connected services, use
[Access](/d0/connect-access) and declare the specific tools or connector operations.
The tool list does not grant new permissions.

## Local storage

Add a `storage` declaration inside `permissions` when the dashboard needs saved
settings or records. This is a manifest fragment:

```json theme={null}
{
  "storage": {
    "preferences": true,
    "collections": ["daily-metrics"],
    "max_bytes": 10000000
  }
}
```

Then use the bridge:

```javascript theme={null}
await window.gatetrix.preferences.set("view", "weekly");
const view = await window.gatetrix.preferences.get("view");

await window.gatetrix.storage.put(
  "daily-metrics", "2026-10-01", { requests: 42 }
);
const records = await window.gatetrix.storage.scan("daily-metrics", {
  start_key: "2026-10-01",
  end_key: "2026-10-31",
  limit: 31
});
```

Storage belongs to the stable dashboard ID and declared collections. It is not
a secret store. Keep API keys and tokens out of preferences and records.

## Trust and failures

Changes to dashboard files require review of the new version before it can use
runtime data capabilities. Builder access does not grant trust.

Handle loading, empty, denied, and failed states visibly. For a failed or uncertain
write through Access, inspect the result or approval request before retrying.
Use **Runtime Audit** to investigate host calls associated with a version.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.