Workspaces and invitations

Manage your workspaces and invite other developer accounts. Workspace members are developers; application users and user groups are separate resources.

API conventions · All endpoints · Schemas

`/e/v1/developer/workspaces/`

List accessible workspaces or create a workspace owned by the authenticated developer.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_workspaces.

No body. Returns separate owned_workspaces and member_workspaces arrays.

Related schemas: Workspace.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "owned_workspaces": [
    {
      "id": "11111111-1111-4111-8111-111111111111",
      "name": "Example",
      "owner_id": "EXAMPLE_OWNER_ID",
      "active_plan_id": "11111111-1111-4111-8111-111111111111",
      "created_at": "2026-10-26T12:00:00Z",
      "updated_at": "2026-10-26T12:00:00Z",
      "is_active": true,
      "member_count": 1
    }
  ],
  "member_workspaces": [
    {
      "id": "11111111-1111-4111-8111-111111111111",
      "name": "Example",
      "owner_id": "EXAMPLE_OWNER_ID",
      "active_plan_id": "11111111-1111-4111-8111-111111111111",
      "created_at": "2026-10-26T12:00:00Z",
      "updated_at": "2026-10-26T12:00:00Z",
      "is_active": true,
      "member_count": 1
    }
  ]
}

POST

Required developer-token scope: write_workspaces.

JSON: required name string, minimum three characters; optional is_active boolean. owner_id, active_plan_id, IDs/timestamps and member_count are read-only. Description/settings are not accepted fields.

Request / response schema: Workspace.

Related schemas: Workspace.

Example request body:

{
  "name": "My application"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

201 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "name": "Example",
  "owner_id": "EXAMPLE_OWNER_ID",
  "active_plan_id": "11111111-1111-4111-8111-111111111111",
  "created_at": "2026-10-26T12:00:00Z",
  "updated_at": "2026-10-26T12:00:00Z",
  "is_active": true,
  "member_count": 1
}

400 — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

400 — json

{
  "detail": "Failed to create workspace. Please try again."
}

`/e/v1/developer/workspaces/{workspace_id}/`

Read, update or delete an accessible workspace.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_workspaces.

Owner or member can read.

Path parameters: workspace_id (uuid, required).

Request / response schema: Workspace.

Related schemas: Workspace.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "name": "Example",
  "owner_id": "EXAMPLE_OWNER_ID",
  "active_plan_id": "11111111-1111-4111-8111-111111111111",
  "created_at": "2026-10-26T12:00:00Z",
  "updated_at": "2026-10-26T12:00:00Z",
  "is_active": true,
  "member_count": 1
}

PUT

Required developer-token scope: write_workspaces.

Partial workspace update, same behavior as PATCH. Only owner may update.

Path parameters: workspace_id (uuid, required).

Request / response schema: Workspace.

Related schemas: Workspace.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "name": "Example",
  "owner_id": "EXAMPLE_OWNER_ID",
  "active_plan_id": "11111111-1111-4111-8111-111111111111",
  "created_at": "2026-10-26T12:00:00Z",
  "updated_at": "2026-10-26T12:00:00Z",
  "is_active": true,
  "member_count": 1
}

400 — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

403 — json

{
  "detail": "Only workspace owners can update workspace settings"
}

PATCH

Required developer-token scope: write_workspaces.

Partial Workspace schema body; only owner may update.

Path parameters: workspace_id (uuid, required).

Request / response schema: Workspace.

Related schemas: Workspace.

Example request body:

{
  "name": "Renamed workspace"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "name": "Example",
  "owner_id": "EXAMPLE_OWNER_ID",
  "active_plan_id": "11111111-1111-4111-8111-111111111111",
  "created_at": "2026-10-26T12:00:00Z",
  "updated_at": "2026-10-26T12:00:00Z",
  "is_active": true,
  "member_count": 1
}

400 — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

403 — json

{
  "detail": "Only workspace owners can update workspace settings"
}

DELETE

Required developer-token scope: write_workspaces.

No body. Only owner may delete. Treat deletion as destructive to workspace resources.

Path parameters: workspace_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

204 — json

No response body.

403 — json

{
  "detail": "Only workspace owners can delete workspaces"
}

`/e/v1/developer/workspaces/{workspace_id}/members/`

List developer members or add an invited developer.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_workspaces.

No body. Must have workspace access.

Path parameters: workspace_id (uuid, required).

Related schemas: WorkspaceMember.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

[
  {
    "id": "11111111-1111-4111-8111-111111111111",
    "workspace": "11111111-1111-4111-8111-111111111111",
    "workspace_name": "EXAMPLE_WORKSPACE_NAME",
    "user_id": "EXAMPLE_USER_ID",
    "role": "owner",
    "created_at": "2026-10-26T12:00:00Z"
  }
]

POST

Required developer-token scope: write_workspaces.

Required JSON user_id (platform account ID); optional role from WorkspaceMember schema. Owner only. The user must be a developer and have accepted an invitation; arbitrary end-users cannot be added.

Path parameters: workspace_id (uuid, required).

Request / response schema: WorkspaceMember.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
body	`user_id`	`not supplied`
body	`role`	`not supplied`

Related schemas: WorkspaceMember.

Example request body:

{
  "user_id": "PLATFORM_ACCOUNT_ID",
  "role": "member"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

201 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "workspace": "11111111-1111-4111-8111-111111111111",
  "workspace_name": "EXAMPLE_WORKSPACE_NAME",
  "user_id": "EXAMPLE_USER_ID",
  "role": "owner",
  "created_at": "2026-10-26T12:00:00Z"
}

400 — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

400 — json

{
  "detail": "user_id is required"
}

400 — json

{
  "detail": "User must accept an invitation before being added to the workspace. Please send an invitation first.",
  "requires_invitation": true
}

400 — json

{
  "detail": "User is already a member of this workspace"
}

403 — json

{
  "detail": "Only workspace owners can add members"
}

403 — json

{
  "detail": "Only developers can be added to workspaces. End-users cannot be added."
}

404 — json

{
  "detail": "User not found"
}

`/e/v1/developer/workspaces/{workspace_id}/members/{member_id}/`

Update or remove a developer membership.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

PATCH

Required developer-token scope: write_workspaces.

Partial WorkspaceMember schema, typically role. Owner only; owner role cannot be changed here.

Path parameters: workspace_id (uuid, required), member_id (uuid, required).

Request / response schema: WorkspaceMember.

Related schemas: WorkspaceMember.

Example request body:

{
  "role": "member"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "workspace": "11111111-1111-4111-8111-111111111111",
  "workspace_name": "EXAMPLE_WORKSPACE_NAME",
  "user_id": "EXAMPLE_USER_ID",
  "role": "owner",
  "created_at": "2026-10-26T12:00:00Z"
}

400 — json

JSON response varies with the request. See the operation requirements and linked schema; validation errors may be keyed by field name.

400 — json

{
  "detail": "Cannot change workspace owner's role"
}

403 — json

{
  "detail": "Only workspace owners can update members"
}

DELETE

Required developer-token scope: write_workspaces.

No body; owner only. Cannot remove the workspace owner.

Path parameters: workspace_id (uuid, required), member_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

204 — json

No response body.

400 — json

{
  "detail": "Cannot remove workspace owner"
}

403 — json

{
  "detail": "Only workspace owners can remove members"
}

`/e/v1/developer/workspaces/{workspace_id}/developers/search/`

Find platform developers to invite.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_workspaces.

Owner only. Required nonempty query string: q, email or query (aliases). Searches developer accounts; returns count/results.

Path parameters: workspace_id (uuid, required).

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
query	`q`	`not supplied`
query	`email`	`not supplied`
query	`query`	`not supplied`

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "count": 1,
  "results": []
}

400 — json

{
  "error": "Search query parameter 'q', 'email', or 'query' is required"
}

403 — json

{
  "detail": "Only workspace owners can search for developers"
}

`/e/v1/developer/workspaces/{workspace_id}/invitations/`

List invitations or invite a platform developer.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_invitations.

Optional status filter.

Path parameters: workspace_id (uuid, required).

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
query	`status`	`not supplied`

Related schemas: WorkspaceInvitation.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

[
  {
    "id": "11111111-1111-4111-8111-111111111111",
    "workspace": "11111111-1111-4111-8111-111111111111",
    "workspace_name": "EXAMPLE_WORKSPACE_NAME",
    "invited_user_id": "EXAMPLE_INVITED_USER_ID",
    "invited_user_email": "EXAMPLE_INVITED_USER_EMAIL",
    "invited_by_id": "EXAMPLE_INVITED_BY_ID",
    "invited_by_email": "EXAMPLE_INVITED_BY_EMAIL",
    "role": "owner",
    "status": "pending",
    "token": "EXAMPLE_TOKEN",
    "expires_at": "2026-10-26T12:00:00Z",
    "accepted_at": "2026-10-26T12:00:00Z",
    "rejected_at": "2026-10-26T12:00:00Z",
    "created_at": "2026-10-26T12:00:00Z",
    "updated_at": "2026-10-26T12:00:00Z",
    "message": "EXAMPLE_MESSAGE",
    "is_expired": true,
    "can_be_accepted": "EXAMPLE_CAN_BE_ACCEPTED"
  }
]

POST

Required developer-token scope: write_invitations.

Owner only. Required invited_user_id (platform ID); optional role (default member), message (string). Rejects existing members and duplicate pending invitations.

Path parameters: workspace_id (uuid, required).

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
body	`invited_user_id`	`not supplied`
body	`role`	`WorkspaceMember.ROLE_MEMBER`
body	`message`	`''`

Related schemas: WorkspaceInvitation.

Example request body:

{
  "invited_user_id": "PLATFORM_ACCOUNT_ID",
  "role": "member",
  "message": "Join our test workspace"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

201 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "workspace": "11111111-1111-4111-8111-111111111111",
  "workspace_name": "EXAMPLE_WORKSPACE_NAME",
  "invited_user_id": "EXAMPLE_INVITED_USER_ID",
  "invited_user_email": "EXAMPLE_INVITED_USER_EMAIL",
  "invited_by_id": "EXAMPLE_INVITED_BY_ID",
  "invited_by_email": "EXAMPLE_INVITED_BY_EMAIL",
  "role": "owner",
  "status": "pending",
  "token": "EXAMPLE_TOKEN",
  "expires_at": "2026-10-26T12:00:00Z",
  "accepted_at": "2026-10-26T12:00:00Z",
  "rejected_at": "2026-10-26T12:00:00Z",
  "created_at": "2026-10-26T12:00:00Z",
  "updated_at": "2026-10-26T12:00:00Z",
  "message": "EXAMPLE_MESSAGE",
  "is_expired": true,
  "can_be_accepted": "EXAMPLE_CAN_BE_ACCEPTED"
}

400 — json

{
  "detail": "invited_user_id is required"
}

400 — json

{
  "detail": "User is already a member of this workspace"
}

400 — json

{
  "detail": "An invitation is already pending for this user"
}

400 — json

{
  "detail": "Failed to create invitation"
}

403 — json

{
  "detail": "Only workspace owners can send invitations"
}

403 — json

{
  "detail": "Only developers can be invited to workspaces"
}

404 — json

{
  "detail": "User not found"
}

500 — json

{
  "detail": "Failed to send invitation"
}

`/e/v1/developer/workspaces/invitations/{invitation_id}/`

Read an invitation or accept/reject it as its recipient.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_invitations.

Invitation must be visible to the current developer.

Path parameters: invitation_id (uuid, required).

Related schemas: WorkspaceInvitation.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "workspace": "11111111-1111-4111-8111-111111111111",
  "workspace_name": "EXAMPLE_WORKSPACE_NAME",
  "invited_user_id": "EXAMPLE_INVITED_USER_ID",
  "invited_user_email": "EXAMPLE_INVITED_USER_EMAIL",
  "invited_by_id": "EXAMPLE_INVITED_BY_ID",
  "invited_by_email": "EXAMPLE_INVITED_BY_EMAIL",
  "role": "owner",
  "status": "pending",
  "token": "EXAMPLE_TOKEN",
  "expires_at": "2026-10-26T12:00:00Z",
  "accepted_at": "2026-10-26T12:00:00Z",
  "rejected_at": "2026-10-26T12:00:00Z",
  "created_at": "2026-10-26T12:00:00Z",
  "updated_at": "2026-10-26T12:00:00Z",
  "message": "EXAMPLE_MESSAGE",
  "is_expired": true,
  "can_be_accepted": "EXAMPLE_CAN_BE_ACCEPTED"
}

POST

Required developer-token scope: write_invitations.

Required JSON action: accept or reject. Acceptance checks expiry/status and creates membership.

Path parameters: invitation_id (uuid, required).

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
body	`action`	`not supplied`

Example request body:

{
  "action": "accept"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "detail": "Invitation accepted successfully"
}

200 — json

{
  "detail": "Invitation rejected"
}

200 — json

{
  "detail": "You are already a member of this workspace"
}

400 — json

{
  "detail": "Action must be 'accept' or 'reject'"
}

400 — json

{
  "detail": "This invitation is EXAMPLE and cannot be accepted"
}

400 — json

{
  "detail": "This invitation has expired"
}

`/e/v1/developer/workspaces/invitations/{invitation_id}/cancel/`

Cancel a pending invitation as workspace owner.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

DELETE

Required developer-token scope: write_invitations.

No body. The route uses DELETE, not POST, regardless of the legacy scope-map entry. Other invitation states cannot be cancelled.

Path parameters: invitation_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

204 — json

No response body.

400 — json

{
  "detail": "Cannot cancel invitation with status EXAMPLE"
}

403 — json

{
  "detail": "Only workspace owners can cancel invitations"
}

`/e/v1/developer/workspaces/invitations/by-token/`

Respond to an email invitation using its secret token.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

POST

Required JSON token, action (accept or reject). Accept while signed in as the invited developer. The invitation token alone does not replace account authentication.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
body	`token`	`not supplied`
body	`action`	`not supplied`

Example request body:

{
  "token": "INVITATION_TOKEN",
  "action": "accept"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "detail": "Invitation accepted successfully"
}

200 — json

{
  "detail": "Invitation rejected"
}

200 — json

{
  "detail": "You are already a member of this workspace"
}

400 — json

{
  "detail": "Token is required"
}

400 — json

{
  "detail": "Action must be 'accept' or 'reject'"
}

400 — json

{
  "detail": "This invitation is EXAMPLE and cannot be accepted"
}

400 — json

{
  "detail": "This invitation has expired"
}

401 — json

{
  "detail": "Authentication required to accept invitation"
}

403 — json

{
  "detail": "This invitation is for a different user"
}

404 — json

{
  "detail": "Invalid invitation token"
}

/e/v1/developer/workspaces/​

GET​

POST​

/e/v1/developer/workspaces/{workspace_id}/​

GET​

PUT​

PATCH​

DELETE​

/e/v1/developer/workspaces/{workspace_id}/members/​

GET​

POST​

/e/v1/developer/workspaces/{workspace_id}/members/{member_id}/​

PATCH​

DELETE​

/e/v1/developer/workspaces/{workspace_id}/developers/search/​

GET​

/e/v1/developer/workspaces/{workspace_id}/invitations/​

GET​

POST​

/e/v1/developer/workspaces/invitations/{invitation_id}/​

GET​

POST​

/e/v1/developer/workspaces/invitations/{invitation_id}/cancel/​

DELETE​

/e/v1/developer/workspaces/invitations/by-token/​

POST​

`/e/v1/developer/workspaces/`

GET

POST

`/e/v1/developer/workspaces/{workspace_id}/`

GET

PUT

PATCH

DELETE

`/e/v1/developer/workspaces/{workspace_id}/members/`

GET

POST

`/e/v1/developer/workspaces/{workspace_id}/members/{member_id}/`

PATCH

DELETE

`/e/v1/developer/workspaces/{workspace_id}/developers/search/`

GET

`/e/v1/developer/workspaces/{workspace_id}/invitations/`

GET

POST

`/e/v1/developer/workspaces/invitations/{invitation_id}/`

GET

POST

`/e/v1/developer/workspaces/invitations/{invitation_id}/cancel/`

DELETE

`/e/v1/developer/workspaces/invitations/by-token/`

POST