Skip to main content
A workspace is the outermost box. Everything else, both the configuration your agents share and everything those agents produce, lives inside exactly one, and nothing crosses between them. Your API key belongs to exactly one workspace, which is why you never send a workspaceId. GET /v1/auth tells you which one a key points at, and who it authenticates as. Members, API keys, and billing are workspace-owned too. Those are managed in the dashboard rather than the public API today.
Top level, nothing owns it · Has many identities · roles · toolsets · connections · profiles · agents · feeds · Scoped by one API key

​
Rules

  • One key, one workspace: no request can read or write across the boundary. See Rules.
  • Feeds and workspace memory are shared inside the boundary; threads, private memory, and artifacts hang off a single agent. See How it fits together.

​
API

  • GET /v1/auth for the principal and workspace behind a credential.