[aka-sacci-ccr]

What

vtex/actions/masterdata/createDocument now always calls Master Data through vcs, which sends X-VTEX-API-AppKey / X-VTEX-API-AppToken when the VTEX app has them configured.

Why

VTEX is rejecting anonymous writes to /api/dataentities. By default (isPrivateEntity unset) this action went through vcsDeprecated, which never sends App Key/Token — only the shopper's cookie — so document creation started failing.

• The action is already defaultVisibility = "private" (not invokable from the browser), so always using the store credentials does not expose them.
• updateDocument and searchDocuments already use vcs — no change.
• isPrivateEntity is kept in Props as @deprecated / @hide and ignored, so existing blocks and TS callers don't break.

Impact on sites

• Sites with App Key/Token configured: creation is now authenticated and works again.
• Sites without them: request stays anonymous, same as before (no regression, still fails if VTEX blocks it). They need to configure a dedicated App Key/Token whose role has Dynamic Storage → Insert or update document.
• Sites that wrap this action in their own public action should pin the acronym and whitelist fields, since writes now carry store credentials.

Testing

• deno task check (fmt, lint, check) passes.
• Not yet tested against a live VTEX account with credentials.

🤖 Generated with Claude Code

---

Summary by cubic

Fixes createDocument so Master Data writes always go through vcs, which sends the app's App Key/Token when configured, because VTEX now rejects anonymous writes to /api/dataentities. The isPrivateEntity prop is deprecated and ignored; vcsDeprecated is no longer used.

Impact

• Sites with App Key/Token configured: document creation is authenticated again.
• Sites without them: requests stay anonymous, unchanged; configure credentials with Dynamic Storage → Insert or update document.
• Wrapper actions should pin the acronym and whitelist fields since writes now carry store credentials.

^{Written for commit e0beadc. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes

  • Document creation requests now consistently use the app’s configured credentials.
  • Requests no longer vary based on the deprecated private-entity setting, providing more predictable behavior.

• Deprecation

  • The private-entity configuration is deprecated and is now ignored for document creation requests.

[github-actions]

Tagging Options

Should a new tag be published when this PR is merged?

• 👍 for Patch 0.165.4 update
• 🎉 for Minor 0.166.0 update
• 🚀 for Major 1.0.0 update

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 054d893d-177c-470d-9c60-8d06751750df

📥 Commits

Reviewing files that changed from the base of the PR and between a00cfd6 and e0beadc.

📒 Files selected for processing: 1

• vtex/actions/masterdata/createDocument.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The action now sends all document-creation requests to the current MasterData endpoint through ctx.vcs. The isPrivateEntity property is documented as deprecated and ignored.

Changes: MasterData document creation

Layer / File(s)	Summary
Unified endpoint routing vtex/actions/masterdata/createDocument.ts	The action now uses ctx.vcs for all document-creation requests. The isPrivateEntity documentation states that the property is ignored and requests use the app’s configured App Key/Token.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Suggested reviewers: gabrielmatosboubee

Merge Risk: ⚪ Minimal · up to e0bea

The routing change is ready for normal merge checks. Live credential-backed creation remains untested, but no concrete failure has been established.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the main change: making Master Data document creation use App Key/Token authentication.
Description check		The description clearly explains the change, reason, impact, compatibility behavior, security considerations, and testing status. It does not include the template's Issue Link, Loom Video, or Demonstr…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly explains the change, reason, impact, compatibility behavior, security considerations, and testing status. It does not include the template's Issue Link, Loom Video, or Demonstration Link sections, but the core information is complete.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 1 file

_{View guided diff | Turn on auto-fix | Re-trigger cubic}