> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace and members

> Workspace configuration and member directory endpoints in the Compliance API

## Workspace

`GET /{workspace_id}`

Returns a single object, not paginated. It contains the workspace identity plus all workspace-level security configuration, reported as effective values. Requires `compliance:inventory:read`.

| Field | Type | Notes |
| - | - | - |
| `id` | string | Workspace ID. |
| `name` | string or null | |
| `created_date` | timestamp or null | |
| `owner` | object | `{ user_id, email }`. |
| `member_count` | integer | Active members, excluding no-access. The owner is always counted. |
| `sso.configured` | boolean | A provider is set up. |
| `sso.provider_name` | string or null | |
| `sso.enforced_for_members` | boolean | Effective. True when a provider is configured, admin SSO login is completed, and enforcement is on. |
| `sso.guests_exempt` | boolean | Guests may bypass SSO. |
| `sso.enforced_for_apps` | boolean | Applies to end users of published apps, and overrides per-app auth methods at serve time. |
| `ip_allowlist.enabled` | boolean | |
| `ip_allowlist.entries[]` | array | `{ ip_address, note }`. |
| `ip_allowlist.governs` | string | Constant `"sign_in"`: platform sign-in, not app serving. |
| `publishing.default_app_visibility` | string | Default for new apps. |
| `publishing.role_policies` | object | Map keyed by role: `{ can_publish, allowed_visibilities[], default_visibility }`. Defaults are materialized. These are three independent controls, not a hierarchy. `can_publish` gates publishing, `allowed_visibilities` limits which visibility the role may set (enforced at creation and on every change), and `default_visibility` is what a new app starts as. |
| `publishing.group_policies` | object | Map keyed by group ID, with the same shape plus `group_name`. A member of a governed group follows the union of their group rows rather than their role row. Owner and viewer are pinned, and no group overrides them. |
| `connector_controls[]` | array | `{ integration_type, builder_connection_enabled, per_user_connection_enabled }`, one row per connector in the catalog. This is effective state, not stored intent. With `new_connectors_default_off` on, a connector that has no governance record and hasn't been set up reports off on both dimensions. |
| `new_connectors_default_off` | boolean | Whether connectors newly released to the catalog start disabled until an admin enables them. Off by default. Turning it on or off writes an explicit record for every connector already in the catalog, so the flip never changes one in use. |
| `superagent_disabled` | boolean | Workspace-level agent kill switch. |
| `apps_mcp_policy` | string | Policy for apps exposing MCP. |
| `verified_email_domains[]` | array of strings | SSO-discovery domains. Unrelated to the email rows in [Domains](https://docs.base44.com/developers/references/compliance-api/get-started/apps-and-domains.md). |
| `restrict_workspace_creation` | boolean | Whether the verified domains also claim new accounts. A signup on one is refused unless a workspace that verified the domain provisions it, and those accounts can't create their own workspaces. Always false when no domain is verified. |
| `guest_invites_admin_only` | boolean | Effective after plan-level resolution. |
| `app_transfer_out` | string | Who can move apps out of the workspace. `"admin"` means admins and owners, `"owner"` means owners only, and `"nobody"` turns it off. |
| `app_transfer_in` | string | Who can move apps into the workspace, as `"any_editor"`, `"admin_approval"`, or `"disabled"`. With `"admin_approval"`, an editor's move waits for an admin. Effective, so a FERPA workspace always reports `"disabled"`. |
| `personal_access_token_policy.allowed` | boolean | Whether members' personal access tokens can act on the workspace. Checked on every request, so turning it off stops every token at once. |
| `personal_access_token_policy.max_permission` | string | The highest permission a token can hold, `"full_access"` or `"read_only"`. Checked when a token is created, edited, or re-enabled. An existing token above it keeps working. |
| `personal_access_token_policy.single_app_only` | boolean | Whether a token has to target exactly one app or Superagent. Checked the same way as `max_permission`. |
| `mfa.enforced_for_members` | boolean | Whether members must have an MFA to reach the workspace. Members covered by enforced workspace SSO are exempt. Per-member enrollment is in [Members](#members). |
| `mfa_policy` | null | Superseded by `mfa`, which carries the workspace MFA requirement. Always null, and removed in v2. |
| `session_policy` | null | Not configurable per workspace. |
| `token_policy` | null | Superseded by `personal_access_token_policy`. Always null, and removed in v2. |
| `data_region` | string | Effective region, or `"CUSTOMER_CLUSTER"`. |
| `static_egress_enabled` | boolean | Static egress IPs are in use. |

This excerpt shows the keyed maps and the materialized defaults, the two shapes the table can't express.

```json theme={null}
{
  "sso": {
    "configured": true,
    "provider_name": "okta",
    "enforced_for_members": true,
    "guests_exempt": false,
    "enforced_for_apps": true
  },
  "publishing": {
    "default_app_visibility": "workspace_with_login",
    "role_policies": {
      "editor": {
        "can_publish": true,
        "allowed_visibilities": ["workspace_with_login"],
        "default_visibility": "workspace_with_login"
      }
    },
    "group_policies": {
      "grp_7": {
        "group_name": "Contractors",
        "can_publish": false,
        "allowed_visibilities": ["private_with_login"],
        "default_visibility": "private_with_login"
      }
    }
  },
  "connector_controls": [
    {
      "integration_type": "slack",
      "builder_connection_enabled": true,
      "per_user_connection_enabled": false
    }
  ]
}
```

## Members

`GET /{workspace_id}/members`

Returns a paginated list. Requires `compliance:members:read`. The list includes pending invitations and blocked members. A compliance directory answers who has or could have access, so filtering to active members would hide exactly the rows an auditor is looking for.

| Field | Type | Notes |
| - | - | - |
| `id` | string | Membership ID. |
| `email` | string | The identity-join key. |
| `user_id` | string or null | Null until the invite is accepted. |
| `role` | string | One of `owner`, `admin`, `editor`, `viewer`, `member`, or `guest`. `member` is legacy and equivalent to `editor`. |
| `role_source` | string | `direct` or `group`. |
| `status` | string | `active` or `pending`. |
| `access_state` | string | `granted` or `blocked`. |
| `created_date` | timestamp | Membership creation, not account creation. For a pending invite, when it was sent. |
| `invited_by` | string or null | Inviter email. |
| `invitation_expired` | boolean | For pending invites. |
| `sso_linked` | boolean | An IdP identity is bound to this membership. |
| `mfa_enrolled` | boolean or null | Account-level, not per membership. Null for a pending invite. |
| `mfa_methods[]` | array of strings | Factor types only, such as `["totp"]`. Never a factor's value. |
| `last_active_at` | timestamp or null | Last authenticated request resolving to this workspace. Not credit consumption. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.