Enable public dashboard inputs and actions

A public dashboard share can be read-only, allow controlled configuration inputs, or expose explicitly approved actions. Treat each level as a separate capability and enable only what the workflow requires.

Public shares use a token in the URL. They do not create an authenticated Envoy user.

Three independent controls

Viewing

ENVOY_PUBLIC_DASHBOARDS_ENABLED controls public share viewing. It defaults on unless set to 0 or false.

Disable it globally when public dashboards are not used:

ENVOY_PUBLIC_DASHBOARDS_ENABLED=false

Input widgets

Public editing of form and field_mapping widgets requires both:

ENVOY_PUBLIC_DASHBOARD_INPUT_ENABLED=true

and:

dashboard:
  allow_public_input: true

The server switch defaults off.

Action widgets

Public action execution requires:

ENVOY_PUBLIC_DASHBOARD_ACTIONS_ENABLED=true

and allow_public: true on the individual action widget. The widget must be on a public page. The action switch defaults off.

Keep all three controls off in environments where they are unnecessary.

Add a controlled form action

dashboard:
  allow_public_input: false
  pages:
    - id: request
      title: Request access
      widgets:
        - id: send_invite
          type: action
          label: Send invite
          description: Send an invitation to an approved domain.
          allow_public: true
          cooldown_seconds: 30
          confirm_message: Send this invitation now?
          form:
            fields:
              - key: email
                label: Work email
                type: text
                format: email
                required: true
          action:
            kind: run_task
            task: invite_user
            arguments_expr: |
              {
                "email": form.email
              }

An action form supplies one execution request; it does not require public job_config editing. Every action opens a confirmation dialog.

Choose an action kind

• run_task starts one task with the job's connector mapping and authored arguments.
• job_run starts the job or selected task keys with the job's existing arguments and job_config.
• connector_method invokes one explicitly authored mapped-connector method.

job_run does not accept client-supplied argument expressions. Use stored job configuration for its inputs.

Never let a public user provide:

• connector name or ID;
• method name;
• endpoint or path;
• arbitrary JSONata;
• raw query;
• tenant or account identity outside a constrained static choice;
• credentials or tokens.

Scope and validate input

For public actions:

• define required fields and formats;
• prefer fixed static options;
• constrain text length and numeric range;
• derive tenant or job identity server-side;
• validate again in the task or connector operation;
• use stable idempotency keys for writes.

The public path ignores client-supplied row context. Dynamic option sources do not turn arbitrary submitted values into trusted values; public actions enforce authored choices.

Concurrency and audit behavior

Envoy prevents duplicate in-flight execution for the same widget and applies cooldown_seconds after an attempt. Every action creates an audit row and links to the task or job run when applicable.

A cooldown reduces accidental repetition; it is not business-level idempotency. The destination write must still reconcile duplicate or ambiguous requests.

Share safely

1. Keep the page read-only first.
2. Verify all data queries have fixed scope.
3. Add one input or action at a time.
4. Enable the server switch in a test environment.
5. test valid, invalid, repeated, and concurrent submissions;
6. confirm action audit rows and underlying runs;
7. inspect the share in a private browser session;
8. enable production only after operational review.

Treat a share URL as a bearer credential. Send it only through an approved channel, revoke it when the audience changes, and do not expose privileged diagnostic pages.

See Author an operational dashboard and Dashboard schema and widgets.