Workspaces
A workspace is a division inside an organization with its own API keys, limits, spend and data. Teams typically create one workspace per environment (production, staging) or per product or customer, so that a test script cannot use production’s budget and a key from one product cannot see another’s files or agents.
Today an organization has no workspaces: every key and every request belongs to the organization directly. When workspaces launch, each organization gets a workspace named Default and all existing keys move into it. Nothing changes for existing traffic.
What belongs to a workspace
| Belongs to one workspace | Stays at organization level |
|---|---|
| API keys (inference keys) | Admin keys |
| Files, batches, webhooks | Plan, billing, credit wallet |
| Agents, sessions, executions, environments, memory stores, vaults, deployments | Members and their organization role |
| Workspace spend limit and rate limits | Organization spend limit and rate-limit tier |
| Data region | Audit log |
| IP allowlist | Single sign-on, directory sync |
Usage and cost are recorded per workspace, so the usage and cost reports can be grouped by workspace_id.
Endpoints
| Method | Path | Purpose |
|---|---|---|
POST | /v1/organizations/workspaces | Create a workspace. |
GET | /v1/organizations/workspaces | List workspaces. |
GET | /v1/organizations/workspaces/{workspace_id} | Read one. |
PATCH | /v1/organizations/workspaces/{workspace_id} | Rename or change settings. |
POST | /v1/organizations/workspaces/{workspace_id}/archive | Archive: all its keys stop working; data is kept. |
POST | /v1/organizations/workspaces/{workspace_id}/unarchive | Undo an archive. |
GET | /v1/organizations/workspaces/{workspace_id}/members | List workspace members. |
POST | /v1/organizations/workspaces/{workspace_id}/members | Add an organization member to the workspace. |
GET | /v1/organizations/workspaces/{workspace_id}/members/{user_id} | Read one membership. |
PATCH | /v1/organizations/workspaces/{workspace_id}/members/{user_id} | Change the workspace role. |
DELETE | /v1/organizations/workspaces/{workspace_id}/members/{user_id} | Remove from the workspace. |
Authenticate with an admin key and send syntic-beta: admin-2026-11-01. Owners and Administrators can manage every workspace.
The workspace object
{
"id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
"type": "workspace",
"name": "production",
"description": "Customer-facing traffic.",
"is_default": false,
"data_region": "us",
"allowed_ips": [],
"spend_limit_usd": "2000.00",
"rate_limits": [{ "model": "Amara S1.2", "requests_per_minute": 800 }],
"archived_at": null,
"created_at": "2026-11-01T09:00:00Z"
}| Field | Description |
|---|---|
name | Unique in the organization, 1 to 40 characters. |
description | Up to 200 characters. |
is_default | true for the Default workspace, which cannot be archived. |
data_region | Where its content is processed and stored. See Data residency. Set at creation. |
allowed_ips | IP allowlist applied to every key in the workspace. See IP allowlists. |
spend_limit_usd | Monthly credit spend cap for the workspace, or null. Managed with Spend limits and shown here for convenience. |
rate_limits | Per-model caps below the organization’s limits. Managed with Rate-limit info. |
archived_at | When it was archived, or null. |
Create a workspace
POST /v1/organizations/workspaces with name (required), description, data_region (default us) and allowed_ips.
curl -sS https://app.syntic.ai/v1/organizations/workspaces \
-H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
-H "Content-Type: application/json" \
-H "syntic-beta: admin-2026-11-01" \
-H "Idempotency-Key: ws-staging-2026-11" \
-d '{"name": "staging", "description": "Pre-release testing."}'List workspaces
GET /v1/organizations/workspaces?limit=20&include_archived=false returns the standard list shape.
Archive
Archiving is how you shut a workspace down safely:
- Every inference key in it fails with
403 permission, codeworkspace_archived, at once. - Running agent sessions are interrupted; deployments are paused.
- Files, sessions, memory and other data are kept, subject to retention, and can be read again after unarchiving.
- The workspace’s name stays reserved until it is unarchived or an Owner deletes it in the Console.
Workspace members and roles
An organization member can be added to any number of workspaces. Owners and Administrators can act in every workspace without being added.
| Workspace role | Can |
|---|---|
workspace_user | Use the workspace in the Console and see its usage. |
workspace_developer | Also create and revoke their own inference keys in the workspace, and build agents. |
workspace_admin | Also manage the workspace’s members, every key in it, its limits and its settings. |
Add a member: POST .../members with {"user_id": "user_...", "role": "workspace_developer"}. Change it: PATCH .../members/{user_id} with {"role": "..."}. Remove: DELETE .../members/{user_id}; their keys in the workspace stop working.
{
"type": "workspace_member",
"workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
"user_id": "user_01J9Y0A2C4E6G8J0L2N4",
"role": "workspace_developer",
"added_at": "2026-11-02T10:00:00Z"
}Errors
Errors use the error envelope.
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request_error | invalid_name | Empty, too long, or uses disallowed characters. |
| 400 | invalid_request_error | unknown_region | data_region is not an available region. |
| 404 | not_found | workspace_not_found, user_not_found | No such workspace or member in the organization. |
| 409 | conflict_error | name_taken | Another workspace has the name. |
| 409 | conflict_error | default_workspace | Archiving the Default workspace. |
| 409 | conflict_error | workspace_limit_reached | More than 100 active workspaces. |
| 409 | conflict_error | region_change_blocked | Changing data_region while the workspace holds content. |
Limits
| Limit | Value |
|---|---|
| Active workspaces per organization | 100 |
| Members per workspace | Same as the organization |
Workspaces are free.
Build notes for the platform team
- Design the workspace schema before the Files and Batches tables are final, so those tables are born with
workspace_id. - Migration: create Default for every organization, set
workspace_idon every key and usage row, then make the column required. - The auth step resolves key → workspace → organization once and passes both ids down; every query filters on
workspace_id.