> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Get workspace configuration
> This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.
Returns the security configuration of a [workspace](/documentation/account-and-billing/about-workspaces).
Use this method to view:
- The workspace owner and member count.
- Security settings, such as [single sign-on](/Enterprise/SSO-for-enterprise-workspace) (SSO), [multi-factor authentication](/Enterprise/SSO-for-enterprise-workspace#requiring-two-factor-authentication) (MFA), and the [IP allowlist](/Enterprise/IP-allowlist).
- The rules for [publishing apps](/Enterprise/Enterprise-SSO-and-app-visibility#setting-publishing-permissions).
To call this method, your API key must include the `compliance:inventory:read` [scope](/developers/references/compliance-api/get-started/authentication#scopes).
## OpenAPI
````yaml /developers/references/compliance-api/compliance-openapi.json get /{workspace_id}
openapi: 3.1.0
info:
title: Base44 Compliance API
description: >
Read-only API for security partners to review the security configuration of
a Base44 workspace.
The API reports what exists in a workspace and how it's configured. It
doesn't report activity. To review activity, use the Audit Logs API.
The Compliance API is available for Enterprise workspaces only. To get
started, see the
[overview](/developers/references/compliance-api/get-started/overview).
version: 1.0.0
servers:
- url: https://app.base44.com/api/v1/compliance
description: Compliance API
security:
- ApiKeyAuth: []
PartnerTokenAuth: []
tags:
- name: compliance
description: Read workspace configuration, inventory, and security posture.
paths:
/{workspace_id}:
get:
tags:
- compliance
summary: Get workspace configuration
description: >-
This API is in beta. Endpoints, fields, and behavior may still
change, so avoid depending on it in production.
Returns the security configuration of a
[workspace](/documentation/account-and-billing/about-workspaces).
Use this method to view:
- The workspace owner and member count.
- Security settings, such as [single
sign-on](/Enterprise/SSO-for-enterprise-workspace) (SSO), [multi-factor
authentication](/Enterprise/SSO-for-enterprise-workspace#requiring-two-factor-authentication)
(MFA), and the [IP allowlist](/Enterprise/IP-allowlist).
- The rules for [publishing
apps](/Enterprise/Enterprise-SSO-and-app-visibility#setting-publishing-permissions).
To call this method, your API key must include the
`compliance:inventory:read`
[scope](/developers/references/compliance-api/get-started/authentication#scopes).
operationId: get_workspace__workspace_id__get
parameters:
- name: workspace_id
in: path
required: true
schema:
type: string
title: Workspace Id
description: >-
Workspace ID. Learn more about how to [retrieve your workspace
ID](/developers/references/compliance-api/get-started/authentication#workspace-id).
example: 67f2c8e01a3b5d004e92d7a1
responses:
'200':
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/ComplianceWorkspace'
'400':
description: >-
The request is invalid, for example a parameter is malformed or the
`cursor` is invalid or expired. The error `type` is
`invalid_request_error`. See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
invalid_request_error:
summary: invalid_request_error
value:
error:
type: invalid_request_error
message: The request is invalid.
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'401':
description: >-
A credential failed. The workspace API key is missing, unknown, or
disabled, or your signed token is missing or Base44 can't verify it
(`partner_key_required`). Check the `code` to see which credential
to fix. Don't ask the workspace admin to create a new key for
`partner_key_required`. The error `type` is `authentication_error`.
See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
authentication_error:
summary: authentication_error
value:
error:
type: authentication_error
message: Invalid workspace API key.
partner_key_required:
summary: partner_key_required
value:
error:
type: authentication_error
message: >-
Missing or invalid compliance partner assertion in the
Authorization header. The workspace API key is sent
separately and is not the credential at fault here.
code: partner_key_required
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'402':
description: >-
The workspace's plan doesn't include the Compliance API, or its
subscription has lapsed (`plan_not_included`). The error `type` is
`permission_error`. See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
plan_not_included:
summary: plan_not_included
value:
error:
type: permission_error
message: This API key is not permitted to perform that request.
code: plan_not_included
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'403':
description: >-
The key doesn't have the scope the method needs (`missing_scope`),
the key belongs to a different workspace (`workspace_mismatch`), the
Compliance API isn't enabled for the workspace
(`feature_not_enabled`), or Base44 suspended your partner
registration (`partner_not_approved`). The error `type` is
`permission_error`. See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
missing_scope:
summary: missing_scope
value:
error:
type: permission_error
message: >-
This API key is not permitted to perform that request.
Needed: [compliance:members:read]
code: missing_scope
required_scope: compliance:members:read
workspace_mismatch:
summary: workspace_mismatch
value:
error:
type: permission_error
message: API key does not belong to this workspace
code: workspace_mismatch
feature_not_enabled:
summary: feature_not_enabled
value:
error:
type: permission_error
message: The Compliance API is not enabled for this workspace.
code: feature_not_enabled
partner_not_approved:
summary: partner_not_approved
value:
error:
type: permission_error
message: >-
This compliance partner is not approved to call the
Compliance API. Contact Base44; the customer cannot
grant this.
code: partner_not_approved
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'404':
description: >-
The workspace doesn't exist. The error `type` is `not_found_error`.
See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
not_found_error:
summary: not_found_error
value:
error:
type: not_found_error
message: Not found.
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'429':
description: >-
The workspace sent too many requests. Wait the number of seconds in
the `retry-after` header, then retry with a newly signed
authentication token. The error `type` is `rate_limit_error`. See
[rate
limits](/developers/references/compliance-api/get-started/rate-limits).
content:
application/json:
examples:
rate_limit_error:
summary: rate_limit_error
value:
error:
type: rate_limit_error
message: >-
Rate limit exceeded. Retry after the interval in the
retry-after header.
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
'500':
description: >-
Something went wrong on Base44's side. Retry with exponential
backoff and a newly signed authentication token. If the code is
`inventory_too_large`, the workspace has more items than the API can
return, and retrying doesn't help. Ask your Base44 partner contact
for help. See [error
codes](/developers/references/compliance-api/get-started/error-codes).
content:
application/json:
examples:
api_error:
summary: api_error
value:
error:
type: api_error
message: >-
An internal error occurred. Retry with exponential
backoff.
inventory_too_large:
summary: inventory_too_large
value:
error:
type: api_error
message: >-
This workspace holds more rows than a single compliance
read supports (9999). Returning a partial inventory
would misreport it, so the request failed instead. Not
retryable without a change on our side.
code: inventory_too_large
schema:
$ref: '#/components/schemas/ComplianceErrorResponse'
components:
schemas:
ComplianceWorkspace:
properties:
id:
type: string
title: Id
description: Unique ID of the workspace.
example: 67f2c8e01a3b5d004e92d7a1
name:
anyOf:
- type: string
- type: 'null'
title: Name
description: Name of the workspace.
example: Acme Engineering
created_date:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Created Date
description: >-
When the workspace was created. Formatted as a UTC timestamp in ISO
8601 format. A `null` value indicates no creation time is recorded.
example: '2025-11-03T14:20:00Z'
owner:
$ref: '#/components/schemas/ComplianceOwner'
description: >-
Details of the workspace owner. A `null` value in either field
indicates no owner is recorded.
member_count:
type: integer
title: Member Count
description: >-
Number of active members in the workspace. Pending invitations and
blocked members aren't counted.
example: 42
sso:
$ref: '#/components/schemas/ComplianceSso'
description: >-
SSO settings for the workspace. See [single sign-on for enterprise
workspaces](/Enterprise/SSO-for-enterprise-workspace).
mfa:
$ref: '#/components/schemas/ComplianceMfa'
description: >-
Multi-factor authentication settings for the workspace. To see which
members have turned it on, use the [List workspace
members](/api-reference/compliance/list-workspace-members) method.
ip_allowlist:
$ref: '#/components/schemas/ComplianceIpAllowlist'
description: >-
IP addresses allowed to sign in to the workspace. See [IP
allowlist](/Enterprise/IP-allowlist).
publishing:
$ref: '#/components/schemas/CompliancePublishing'
description: >-
Rules for publishing apps in the workspace. See [managing apps in
your enterprise
workspace](/Enterprise/Enterprise-SSO-and-app-visibility).
connector_controls:
items:
$ref: '#/components/schemas/ComplianceConnectorControl'
type: array
title: Connector Controls
description: >-
Availability of each connector in the workspace. See [managing
connector availability](/Enterprise/workspace-connectors) for more
details.
new_connectors_default_off:
type: boolean
title: New Connectors Default Off
description: >-
Whether an admin must enable new connectors before anyone in the
workspace can use them.
superagent_disabled:
type: boolean
title: Superagent Disabled
description: Whether Superagents are disabled for the workspace.
example: false
apps_mcp_policy:
type: string
title: Apps Mcp Policy
description: >-
Whether apps can run MCP servers. Possible values are `"allow"`,
`"oauth_only"`, and `"disabled"`.
example: oauth_only
verified_email_domains:
items:
type: string
type: array
title: Verified Email Domains
description: >-
Email domains the workspace has verified. People with an email
address on one of these domains are offered SSO when they sign in.
These domains are separate from the `"email"` domains the [List
domains](/api-reference/compliance/list-domains) method returns,
which apps use to send email. Learn more about [setting up your
enterprise workspace
domain](/Enterprise/Enterprise-workspace-domain).
example:
- acme.com
restrict_workspace_creation:
type: boolean
title: Restrict Workspace Creation
description: >-
Whether the workspace has [claimed its verified email
domains](/Enterprise/restrict-workspace-creation). When `true`:
- New sign-ups on those domains are refused, unless a workspace that
verified the domain admits the user.
- Users on those domains can't create workspaces, unless they're
admins of a workspace that verified the domain.
This is always `false` when the workspace has no verified email
domains.
example: true
guest_invites_admin_only:
type: boolean
title: Guest Invites Admin Only
description: >-
Whether only owners and admins can invite guests. The default value
depends on the plan:
- Business and Enterprise plans: `true`
- Other plans: `false`
example: true
app_transfer_out:
type: string
enum:
- admin
- owner
- nobody
title: App Transfer Out
description: |-
Who can move apps out of this workspace. Possible values are:
- `admin`: Admins and owners can move apps out.
- `owner`: Only owners can move apps out.
- `nobody`: Nobody can move apps out.
example: admin
app_transfer_in:
type: string
enum:
- any_editor
- admin_approval
- disabled
title: App Transfer In
description: >-
Who can move apps into this workspace. Possible values are
`"any_editor"`, `"admin_approval"` (an editor's move waits for a
workspace admin), and `"disabled"`. A workspace whose plan can't
configure it reports the default, `"disabled"` for workspaces that
follow the Family Educational Rights and Privacy Act (FERPA) and
`"any_editor"` otherwise.
example: admin_approval
personal_access_token_policy:
$ref: '#/components/schemas/CompliancePersonalAccessTokenPolicy'
description: >-
Rules for members' [personal access
tokens](/Workspaces/Personal-access-tokens) in the workspace. See
[governing personal access
tokens](/Enterprise/workspace-secrets#governing-personal-access-tokens).
mfa_policy:
type: 'null'
title: Mfa Policy
description: Always `null`. Use `mfa` instead.
session_policy:
type: 'null'
title: Session Policy
description: Always `null`. Workspaces can't set a session policy.
token_policy:
type: 'null'
title: Token Policy
description: Always `null`. Use `personal_access_token_policy` instead.
data_region:
type: string
title: Data Region
description: >-
Region for apps created in the workspace from now on. Existing apps
keep their region. To see where an app's data is stored, use
`data_region` on the apps endpoints. Possible values are `"US"`,
`"EU"`, `"UK"`, `"AU"`, and `"CUSTOMER_CLUSTER"`. A value of
`"CUSTOMER_CLUSTER"` indicates the workspace uses its own MongoDB
database. See [connecting your own
MongoDB](/Enterprise/connecting-your-own-mongodb).
example: US
static_egress_enabled:
type: boolean
title: Static Egress Enabled
description: >-
Whether apps send their outgoing traffic from fixed IP addresses.
See [static outbound IPs](/Enterprise/static-outbound-ips).
example: false
type: object
required:
- id
- owner
- member_count
- sso
- mfa
- ip_allowlist
- publishing
- connector_controls
- new_connectors_default_off
- superagent_disabled
- apps_mcp_policy
- verified_email_domains
- restrict_workspace_creation
- guest_invites_admin_only
- app_transfer_out
- app_transfer_in
- personal_access_token_policy
- data_region
- static_egress_enabled
title: ComplianceWorkspace
ComplianceErrorResponse:
properties:
error:
$ref: '#/components/schemas/ComplianceErrorBody'
type: object
required:
- error
title: ComplianceErrorResponse
ComplianceOwner:
properties:
user_id:
anyOf:
- type: string
- type: 'null'
title: User Id
description: Unique ID of the workspace owner's Base44 account.
example: 679e0f3a8b1c2d004a73f5b8
email:
anyOf:
- type: string
- type: 'null'
title: Email
description: Email address of the workspace owner.
example: owner@acme.com
type: object
title: ComplianceOwner
ComplianceSso:
properties:
configured:
type: boolean
title: Configured
description: Whether the workspace has SSO set up with an identity provider.
example: true
provider_name:
anyOf:
- type: string
- type: 'null'
title: Provider Name
description: >-
Name of the workspace's identity provider. A `null` value indicates
none is set up.
example: Okta
enforced_for_members:
type: boolean
title: Enforced For Members
description: >-
Whether members are required to sign in with SSO. This is `true`
only when a provider is set up, an admin has signed in with it, and
enforcement is enabled.
example: true
guests_exempt:
type: boolean
title: Guests Exempt
description: Whether guests can sign in without SSO.
example: false
enforced_for_apps:
type: boolean
title: Enforced For Apps
description: >-
Whether people who use the workspace's published apps are required
to sign in with SSO.
example: true
type: object
required:
- configured
- enforced_for_members
- guests_exempt
- enforced_for_apps
title: ComplianceSso
ComplianceMfa:
properties:
enforced_for_members:
type: boolean
title: Enforced For Members
description: >-
Whether MFA is required to open the workspace. Not enforced for
members who must sign in with SSO. To see which members have enabled
MFA, use the [List workspace
members](/api-reference/compliance/list-workspace-members) method.
example: true
type: object
required:
- enforced_for_members
title: ComplianceMfa
ComplianceIpAllowlist:
properties:
enabled:
type: boolean
title: Enabled
description: Whether members can only sign in from the listed IP addresses.
example: true
entries:
items:
$ref: '#/components/schemas/ComplianceIpAllowlistEntry'
type: array
title: Entries
description: IP addresses members can sign in from.
governs:
type: string
const: sign_in
title: Governs
description: >-
What the IP allowlist restricts. Always `"sign_in"`, which indicates
the allowlist applies to signing in to Base44, not to visits to
published apps.
default: sign_in
example: sign_in
type: object
required:
- enabled
- entries
title: ComplianceIpAllowlist
CompliancePublishing:
properties:
default_app_visibility:
type: string
title: Default App Visibility
description: >-
Who can open apps by default. Possible values are:
- `public_without_login`: Public, no login. Anyone on the internet.
No account needed.
- `public_with_login`: Public, login required. Users who sign in
with one of the app's enabled sign-in methods, including users
outside the workspace.
- `workspace_with_login`: Workspace. Users in the Base44 workspace.
- `private_with_login`: Private. Only invited users.
example: workspace_with_login
role_policies:
additionalProperties:
$ref: '#/components/schemas/ComplianceRolePolicy'
type: object
title: Role Policies
description: Publishing rules for each role, keyed by role name.
group_policies:
additionalProperties:
$ref: '#/components/schemas/ComplianceGroupPolicy'
type: object
title: Group Policies
description: Publishing rules for each workspace group, keyed by group ID.
type: object
required:
- default_app_visibility
- role_policies
- group_policies
title: CompliancePublishing
ComplianceConnectorControl:
properties:
integration_type:
type: string
title: Integration Type
description: Service the connector is for.
example: slack
builder_connection_enabled:
type: boolean
title: Builder Connection Enabled
description: Whether members can connect this connector in the builder.
example: true
per_user_connection_enabled:
type: boolean
title: Per User Connection Enabled
description: >-
Whether app users can connect their own accounts to this connector.
A workspace without credentials set up for the connector returns
`false`.
example: true
type: object
required:
- integration_type
- builder_connection_enabled
- per_user_connection_enabled
title: ComplianceConnectorControl
CompliancePersonalAccessTokenPolicy:
properties:
allowed:
type: boolean
title: Allowed
description: >-
Whether members' personal access tokens may act against this
workspace. Read on every request, so disabling it stops every token
at once.
max_permission:
$ref: '#/components/schemas/PersonalAccessTokenPermission'
description: >-
Highest permission a member can give a personal access token. Base44
checks this when a member creates, edits, or re-enables a token. A
token that already has a higher permission keeps working.
single_app_only:
type: boolean
title: Single App Only
description: >-
Whether a token must target exactly one app or Superagent. Checked
like `max_permission`.
type: object
required:
- allowed
- max_permission
- single_app_only
title: CompliancePersonalAccessTokenPolicy
ComplianceErrorBody:
properties:
type:
type: string
title: Type
description: >-
Category of the error. See [error
types](/developers/references/compliance-api/get-started/error-codes#error-types).
example: permission_error
message:
type: string
title: Message
description: Explanation of the error for people to read.
example: >-
This API key is not permitted to perform that request. Needed:
[compliance:members:read]
code:
anyOf:
- type: string
- type: 'null'
title: Code
description: >-
Specific cause of the error, such as `missing_scope`,
`workspace_mismatch`, `plan_not_included`, `feature_not_enabled`,
`partner_key_required`, `partner_not_approved`, or
`inventory_too_large`. Omitted when `type` is enough. See
[Compliance API
codes](/developers/references/compliance-api/get-started/error-codes#compliance-api-codes).
example: missing_scope
required_scope:
anyOf:
- type: string
- type: 'null'
title: Required Scope
description: >-
Scope the method needs. Included only when `code` is
`missing_scope`.
example: compliance:members:read
type: object
required:
- type
- message
title: ComplianceErrorBody
ComplianceIpAllowlistEntry:
properties:
ip_address:
type: string
title: Ip Address
description: IP address allowed to sign in.
example: 203.0.113.7
note:
anyOf:
- type: string
- type: 'null'
title: Note
description: >-
Description of the IP address. A `null` value indicates no
description was added.
example: Acme office
type: object
required:
- ip_address
title: ComplianceIpAllowlistEntry
ComplianceRolePolicy:
properties:
can_publish:
type: boolean
title: Can Publish
description: Whether the role, or group, can publish apps.
example: true
allowed_visibilities:
items:
type: string
type: array
title: Allowed Visibilities
description: >-
Visibilities the role, or group, can choose when publishing.
Possible values are the same as for `visibility_configured` in the
[List apps](/api-reference/compliance/list-apps) method.
example:
- workspace_with_login
- private_with_login
default_visibility:
type: string
title: Default Visibility
description: Default visibility used when the role, or group, creates an app.
example: private_with_login
type: object
required:
- can_publish
- allowed_visibilities
- default_visibility
title: ComplianceRolePolicy
ComplianceGroupPolicy:
properties:
can_publish:
type: boolean
title: Can Publish
description: Whether the role, or group, can publish apps.
example: true
allowed_visibilities:
items:
type: string
type: array
title: Allowed Visibilities
description: >-
Visibilities the role, or group, can choose when publishing.
Possible values are the same as for `visibility_configured` in the
[List apps](/api-reference/compliance/list-apps) method.
example:
- workspace_with_login
- private_with_login
default_visibility:
type: string
title: Default Visibility
description: Default visibility used when the role, or group, creates an app.
example: private_with_login
group_name:
anyOf:
- type: string
- type: 'null'
title: Group Name
description: >-
Name of the group. A `null` value indicates the group no longer
exists.
example: Engineering
type: object
required:
- can_publish
- allowed_visibilities
- default_visibility
title: ComplianceGroupPolicy
description: Publishing rules for a workspace group.
PersonalAccessTokenPermission:
type: string
enum:
- full_access
- read_only
title: PersonalAccessTokenPermission
description: >-
What a personal access token can do. A token never exceeds its owner's
permissions.
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: api_key
description: >-
Identifies the workspace you can read and limits your access to the
key's scopes. A workspace owner or admin creates the key and shares it
with you. See [Workspace API
key](/developers/references/compliance-api/get-started/authentication#workspace-api-key)
for more details.
PartnerTokenAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: >-
The signed authentication token that identifies you as the security
partner. Sign a new token for each request with your signing key, using
`RS256` or `ES256`, and send it as a bearer token in the `Authorization`
header. See [Sign an authentication
token](/developers/references/compliance-api/get-started/authentication#sign-an-authentication-token)
for more details.
````
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.