Skip to main content
GET
Get workspace configuration

Authorizations

api_key
string
header
required

Identifies the workspace you can read and limits your access to the key's scopes. A workspace owner or admin creates the key and shares it with you. See Workspace API key for more details.

Authorization
string
header
required

The signed authentication token that identifies you as the security partner. Sign a new token for each request with your signing key, using RS256 or ES256, and send it as a bearer token in the Authorization header. See Sign an authentication token for more details.

Path Parameters

workspace_id
string
required

Workspace ID. Learn more about how to retrieve your workspace ID.

Response

Successful Response

id
string
required

Unique ID of the workspace.

Example:

"67f2c8e01a3b5d004e92d7a1"

owner
ComplianceOwner · object
required

Details of the workspace owner. A null value in either field indicates no owner is recorded.

member_count
integer
required

Number of active members in the workspace. Pending invitations and blocked members aren't counted.

Example:

42

sso
ComplianceSso · object
required

SSO settings for the workspace. See single sign-on for enterprise workspaces.

mfa
ComplianceMfa · object
required

Multi-factor authentication settings for the workspace. To see which members have turned it on, use the List workspace members method.

ip_allowlist
ComplianceIpAllowlist · object
required

IP addresses allowed to sign in to the workspace. See IP allowlist.

publishing
CompliancePublishing · object
required

Rules for publishing apps in the workspace. See managing apps in your enterprise workspace.

connector_controls
ComplianceConnectorControl · object[]
required

Availability of each connector in the workspace. See managing connector availability for more details.

new_connectors_default_off
boolean
required

Whether an admin must enable new connectors before anyone in the workspace can use them.

superagent_disabled
boolean
required

Whether Superagents are disabled for the workspace.

Example:

false

apps_mcp_policy
string
required

Whether apps can run MCP servers. Possible values are "allow", "oauth_only", and "disabled".

Example:

"oauth_only"

verified_email_domains
string[]
required

Email domains the workspace has verified. People with an email address on one of these domains are offered SSO when they sign in. These domains are separate from the "email" domains the List domains method returns, which apps use to send email. Learn more about setting up your enterprise workspace domain.

Example:
restrict_workspace_creation
boolean
required

Whether the workspace has claimed its verified email domains. When true:

  • New sign-ups on those domains are refused, unless a workspace that verified the domain admits the user.
  • Users on those domains can't create workspaces, unless they're admins of a workspace that verified the domain.

This is always false when the workspace has no verified email domains.

Example:

true

guest_invites_admin_only
boolean
required

Whether only owners and admins can invite guests. The default value depends on the plan:

  • Business and Enterprise plans: true
  • Other plans: false
Example:

true

app_transfer_out
enum<string>
required

Who can move apps out of this workspace. Possible values are:

  • admin: Admins and owners can move apps out.
  • owner: Only owners can move apps out.
  • nobody: Nobody can move apps out.
Available options:
admin,
owner,
nobody
Example:

"admin"

app_transfer_in
enum<string>
required

Who can move apps into this workspace. Possible values are "any_editor", "admin_approval" (an editor's move waits for a workspace admin), and "disabled". A workspace whose plan can't configure it reports the default, "disabled" for workspaces that follow the Family Educational Rights and Privacy Act (FERPA) and "any_editor" otherwise.

Available options:
any_editor,
admin_approval,
disabled
Example:

"admin_approval"

personal_access_token_policy
CompliancePersonalAccessTokenPolicy · object
required

Rules for members' personal access tokens in the workspace. See governing personal access tokens.

data_region
string
required

Region for apps created in the workspace from now on. Existing apps keep their region. To see where an app's data is stored, use data_region on the apps endpoints. Possible values are "US", "EU", "UK", "AU", and "CUSTOMER_CLUSTER". A value of "CUSTOMER_CLUSTER" indicates the workspace uses its own MongoDB database. See connecting your own MongoDB.

Example:

"US"

static_egress_enabled
boolean
required

Whether apps send their outgoing traffic from fixed IP addresses. See static outbound IPs.

Example:

false

name
string | null

Name of the workspace.

Example:

"Acme Engineering"

created_date
string<date-time> | null

When the workspace was created. Formatted as a UTC timestamp in ISO 8601 format. A null value indicates no creation time is recorded.

Example:

"2025-11-03T14:20:00Z"

mfa_policy
null

Always null. Use mfa instead.

session_policy
null

Always null. Workspaces can't set a session policy.

token_policy
null

Always null. Use personal_access_token_policy instead.