Mentions

Bootstrapware stores no user directory and has no mention-search endpoint. The host supplies searchMentionCandidates and resolveUsers in local, BYO, and Hosted. Return only people this viewer may discover on this resource. Cap the page at 20. Another tenant's users are absent.

searchMentionCandidates({ query, tenantKey, resourceType, resourceId, viewerId })
resolveUsers({ ids })

A mention value is a stable user id, not text parsed from an at-sign. Typing @someone without a selected candidate stays plain text. The server does not parse ids out of the body.

On submit or edit, the browser sends the draft to your server. Your server checks each mention id against its own membership list, then mints an author token whose mentions array is exactly those ids. The widget submits the comment with that token. The Hosted API rejects any mention id that is not in the claim with validation_error. A suggestion in the browser is not a grant. BYO performs the same check before it stores the row.

Absent or empty mentions grants zero mention ids, not every user. Mentioning a person does not grant them access. Self-mentions may be stored when the host put that id in the allow-list. They emit no comments.user_mentioned event.

Spans are { userId, start, end } in code-point offsets into the normalized body. end is exclusive, start < end, spans do not overlap, and they are sorted by start. Maximum 20 mentions per comment. Display text inside the span is not an id.

A newly applied create or edit emits one comments.user_mentioned per user id in the new set minus the previous set minus the actor. Replay emits none. Removing a mention emits nothing. The event carries ids only. Your app decides whether to email or push. Comments does not send email. See notification callbacks.