Get tenant preview token requirements

Returns values an Admin must supply before previewing a dashboard as a tenant or tenant user. Requirements come from active persisted-RLS parameters whose source is TOKEN and unresolved placeholders in the actor's effective connection-security templates. Analysis covers every actor-applicable Unified Security connection in the project because the resulting access token is project-scoped. Consumers used by the selected dashboard are marked for display priority.

This operation is read-only metadata for agents and troubleshooting. The dashboard View-as UI uses its server-side mint action as one authoritative round trip; both interfaces call the same analyzer. This operation never accepts or returns parameter values, project credentials, or a signed token. It does not change row-, connection-, or schema-level security. Schema-level security remains outside this requirement-discovery contract. Expected policy outcomes return HTTP 200:

Branch on status and diagnostic code; do not parse customer-facing messages.

A typical agent workflow is:

1. Call this operation with the dashboard and actor.
2. If status is INPUT_REQUIRED, collect every requirement where required is true. Optional requirements may also be supplied.
3. Mint the normal project token for the same actor. Put PLAIN values in securityParams and SECRET values in secretSecurityParams. The token result remains authoritative.
4. If status is BLOCKED, stop. Use the diagnostic codes and requestId to review the security configuration.

curl -X post "https://semaphor.cloud/api/management/v1/projects/string/unified-security/tenant-preview-requirements" \  -H "Content-Type: application/json" \  -d '{    "dashboardId": "dashboard_123",    "actor": {      "kind": "TENANT",      "tenantId": "tenant_123"    }  }'

{
  "ok": true,
  "data": {
    "status": "INPUT_REQUIRED",
    "requirements": [
      {
        "name": "tenant_id",
        "sensitivity": "PLAIN",
        "required": true,
        "allowedValueTypes": [
          "STRING",
          "NUMBER",
          "BOOLEAN",
          "STRING_LIST",
          "NUMBER_LIST"
        ],
        "defaultValueType": "STRING",
        "consumers": [
          {
            "layer": "RLS",
            "definitionId": "definition_123",
            "definitionName": "Tenant isolation",
            "connectionId": "connection_123",
            "connectionName": "Production warehouse",
            "usedByCurrentDashboard": true,
            "ruleNames": [
              "Tenant filter"
            ],
            "requirement": "REQUIRED",
            "whenOmitted": "BLOCK_QUERY"
          }
        ]
      }
    ],
    "diagnostics": [
      {
        "code": "TOKEN_VALUE_REQUIRED",
        "severity": "ERROR",
        "message": "tenant_id is required to open this tenant preview.",
        "parameterName": "tenant_id",
        "connectionIds": [
          "connection_123"
        ],
        "remediation": "SUPPLY_TOKEN_VALUE"
      }
    ],
    "requestId": "request_123"
  }
}

{
  "ok": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "string",
    "requestId": "string",
    "issues": [
      {
        "code": "INVALID_JSON",
        "fieldPath": "string",
        "message": "string"
      }
    ]
  }
}

{
  "ok": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "string",
    "details": {}
  }
}

{
  "ok": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "string",
    "details": {}
  }
}

{
  "ok": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "string",
    "requestId": "string",
    "issues": [
      {
        "code": "INVALID_JSON",
        "fieldPath": "string",
        "message": "string"
      }
    ]
  }
}

{
  "ok": false,
  "error": {
    "code": "INVALID_REQUEST",
    "message": "string",
    "requestId": "string",
    "issues": [
      {
        "code": "INVALID_JSON",
        "fieldPath": "string",
        "message": "string"
      }
    ]
  }
}