Workspace and members - Base44 Support Documentation

Workspace

GET /{workspace_id} Returns a single object, not paginated. It contains the workspace identity plus all workspace-level security configuration, reported as effective values. Requires compliance:inventory:read.

Field	Type	Notes
`id`	string	Workspace ID.
`name`	string or null
`created_date`	timestamp or null
`owner`	object	`{ user_id, email }`.
`member_count`	integer	Active members, excluding no-access. The owner is always counted.
`sso.configured`	boolean	A provider is set up.
`sso.provider_name`	string or null
`sso.enforced_for_members`	boolean	Effective. True when a provider is configured, admin SSO login is completed, and enforcement is on.
`sso.guests_exempt`	boolean	Guests may bypass SSO.
`sso.enforced_for_apps`	boolean	Applies to end users of published apps, and overrides per-app auth methods at serve time.
`ip_allowlist.enabled`	boolean
`ip_allowlist.entries[]`	array	`{ ip_address, note }`.
`ip_allowlist.governs`	string	Constant `"sign_in"`: platform sign-in, not app serving.
`publishing.default_app_visibility`	string	Default for new apps.
`publishing.role_policies`	object	Map keyed by role: `{ can_publish, allowed_visibilities[], default_visibility }`. Defaults are materialized. These are three independent controls, not a hierarchy. `can_publish` gates publishing, `allowed_visibilities` limits which visibility the role may set (enforced at creation and on every change), and `default_visibility` is what a new app starts as.
`publishing.group_policies`	object	Map keyed by group ID, with the same shape plus `group_name`. A member of a governed group follows the union of their group rows rather than their role row. Owner and viewer are pinned, and no group overrides them.
`connector_controls[]`	array	`{ integration_type, builder_connection_enabled, per_user_connection_enabled }`, one row per connector in the catalog. This is effective state, not stored intent. With `new_connectors_default_off` on, a connector that has no governance record and hasn’t been set up reports off on both dimensions.
`new_connectors_default_off`	boolean	Whether connectors newly released to the catalog start disabled until an admin enables them. Off by default. Turning it on or off writes an explicit record for every connector already in the catalog, so the flip never changes one in use.
`superagent_disabled`	boolean	Workspace-level agent kill switch.
`apps_mcp_policy`	string	Policy for apps exposing MCP.
`verified_email_domains[]`	array of strings	SSO-discovery domains. Unrelated to the email rows in Domains.
`restrict_workspace_creation`	boolean	Whether the verified domains also claim new accounts. A signup on one is refused unless a workspace that verified the domain provisions it, and those accounts can’t create their own workspaces. Always false when no domain is verified.
`guest_invites_admin_only`	boolean	Effective after plan-level resolution.
`app_transfer_out`	string	Who can move apps out of the workspace. `"admin"` means admins and owners, `"owner"` means owners only, and `"nobody"` turns it off.
`app_transfer_in`	string	Who can move apps into the workspace, as `"any_editor"`, `"admin_approval"`, or `"disabled"`. With `"admin_approval"`, an editor’s move waits for an admin. Effective, so a FERPA workspace always reports `"disabled"`.
`personal_access_token_policy.allowed`	boolean	Whether members’ personal access tokens can act on the workspace. Checked on every request, so turning it off stops every token at once.
`personal_access_token_policy.max_permission`	string	The highest permission a token can hold, `"full_access"` or `"read_only"`. Checked when a token is created, edited, or re-enabled. An existing token above it keeps working.
`personal_access_token_policy.single_app_only`	boolean	Whether a token has to target exactly one app or Superagent. Checked the same way as `max_permission`.
`mfa.enforced_for_members`	boolean	Whether members must have an MFA to reach the workspace. Members covered by enforced workspace SSO are exempt. Per-member enrollment is in Members.
`mfa_policy`	null	Superseded by `mfa`, which carries the workspace MFA requirement. Always null, and removed in v2.
`session_policy`	null	Not configurable per workspace.
`token_policy`	null	Superseded by `personal_access_token_policy`. Always null, and removed in v2.
`data_region`	string	Effective region, or `"CUSTOMER_CLUSTER"`.
`static_egress_enabled`	boolean	Static egress IPs are in use.

This excerpt shows the keyed maps and the materialized defaults, the two shapes the table can’t express.

{
  "sso": {
    "configured": true,
    "provider_name": "okta",
    "enforced_for_members": true,
    "guests_exempt": false,
    "enforced_for_apps": true
  },
  "publishing": {
    "default_app_visibility": "workspace_with_login",
    "role_policies": {
      "editor": {
        "can_publish": true,
        "allowed_visibilities": ["workspace_with_login"],
        "default_visibility": "workspace_with_login"
      }
    },
    "group_policies": {
      "grp_7": {
        "group_name": "Contractors",
        "can_publish": false,
        "allowed_visibilities": ["private_with_login"],
        "default_visibility": "private_with_login"
      }
    }
  },
  "connector_controls": [
    {
      "integration_type": "slack",
      "builder_connection_enabled": true,
      "per_user_connection_enabled": false
    }
  ]
}

Members

GET /{workspace_id}/members Returns a paginated list. Requires compliance:members:read. The list includes pending invitations and blocked members. A compliance directory answers who has or could have access, so filtering to active members would hide exactly the rows an auditor is looking for.

Field	Type	Notes
`id`	string	Membership ID.
`email`	string	The identity-join key.
`user_id`	string or null	Null until the invite is accepted.
`role`	string	One of `owner`, `admin`, `editor`, `viewer`, `member`, or `guest`. `member` is legacy and equivalent to `editor`.
`role_source`	string	`direct` or `group`.
`status`	string	`active` or `pending`.
`access_state`	string	`granted` or `blocked`.
`created_date`	timestamp	Membership creation, not account creation. For a pending invite, when it was sent.
`invited_by`	string or null	Inviter email.
`invitation_expired`	boolean	For pending invites.
`sso_linked`	boolean	An IdP identity is bound to this membership.
`mfa_enrolled`	boolean or null	Account-level, not per membership. Null for a pending invite.
`mfa_methods[]`	array of strings	Factor types only, such as `["totp"]`. Never a factor’s value.
`last_active_at`	timestamp or null	Last authenticated request resolving to this workspace. Not credit consumption.