Configure the site's visitor access gate: mode (public, email_capture, allowlist, password), the credentials the chosen mode requires (allowlist entries, lead-capture fields, plaintext password), optional email-verification flag (email_capture only), and optional expiry. Allowlist and lead_fields are FULL REPLACEMENTS (not merges); omit lead_fields to leave the current fields unchanged, pass [] to clear. Password mode takes plaintext (hashed server-side with bcrypt) and is never returned or logged. Does not modify the gate design — use set_gate_design for that. Requires editor role.
| Name | Type | Required | Description |
|---|---|---|---|
| request_id | string | Yes | Unique mutation ID. Reuse only to replay identical arguments; use a new ID for changed arguments. |
| site_id | uuid | Yes | Site UUID from list_sites or create_site. |
| mode | enum public | email_capture | allowlist | password | Yes | Gate access mode: public (open), email_capture (soft gate), allowlist (verified email against a typed allowlist), or password (shared bcrypt-hashed password). |
| expires_at | timestamp or null | No | ISO-8601 timestamp OR explicit null to clear. Absence leaves the current value unchanged. Must be in the future when non-null. At the timestamp the room closes for EVERYONE, including verified visitors. |
| lead_fields | array of object or object or object | No | Full REPLACEMENT of the site's lead-capture fields (not a merge). Omit to leave the current fields unchanged; pass [] to clear. Up to 6 fields; the email field is implicit and not counted. Canonical types: short_text, dropdown (requires options[]), checkbox. |
| require_email_verification | boolean | No | When true, visitors must click a magic link before access is granted (email_capture only). Ignored on other modes. |
| allowlist | array of object or object | No | Full REPLACEMENT of the site's allowlist (not a merge). Each entry is { type: 'exact' | 'domain', value }; values are lowercased server-side. Domain matches are exact on the email's domain part (no subdomain rollup). Pass [] to clear every entry. |
| password | string | No | Plaintext password for the shared site gate; hashed server-side with bcrypt. 8..200 chars. Never returned, never logged. |
| Name | Type | Description |
|---|---|---|
| site_id | uuid | — |
| mode | enum public | email_capture | allowlist | password | — |
| has_password | boolean | — |
| allowlist_count | integer | — |
| lead_fields_count | integer | — |
| require_email_verification | boolean or null | — |
| expires_at | timestamp or null | — |
| idempotency_replay | false | — |
set_gate_access is called by an AI assistant connected to Sentway over MCP, not by hand. Point the assistant at the Sentway MCP endpoint and complete the OAuth flow, and the tool becomes available in the same session as the other 38 Sentway tools. See connecting over MCP.