Permission groups

Update permission group

Update a permission group. Omitted fields remain unchanged; config keys are patched and supplied arrays replace their lists. Promoting a group to default demotes the previous default; demoting without workspaceIds leaves it inactive. Overlapping member or all-member scopes conflict. Requires organization Admin or owner access and active Access Control. Workspace API keys return `403`; use a personal API key or scoped OAuth token. OAuth scope: `api:write`.

PATCH/api/v2/organizations/{organizationId}/permission-groups/{groupId}

Update a permission group. Omitted fields remain unchanged; config keys are patched and supplied arrays replace their lists. Promoting a group to default demotes the previous default; demoting without workspaceIds leaves it inactive. Overlapping member or all-member scopes conflict. Requires organization Admin or owner access and active Access Control. Workspace API keys return 403; use a personal API key or scoped OAuth token.

OAuth scope: api:write.

Authentication

Send a personal or workspace API key in X-API-Key. See key types and access; operations that reject workspace keys say so in their description.

Send X-API-Key in the request header.

Alternatively

Send a Sim OAuth access token in Authorization: Bearer. See OAuth authentication and scopes.

Authorization: Bearer YOUR_ACCESS_TOKEN

Required scopes: api:write

OAuth flows

json

{
  "authorizationCode": {
    "authorizationUrl": "https://www.sim.ai/api/auth/oauth2/authorize",
    "tokenUrl": "https://www.sim.ai/api/auth/oauth2/token",
    "refreshUrl": "https://www.sim.ai/api/auth/oauth2/token",
    "scopes": {
      "api:read": "Read your workspaces, workflows, files, tables, and logs",
      "api:write": "Read, create, change, run, and delete resources in your workspaces",
      "offline_access": "Stay signed in without asking again"
    }
  }
}

OAuth scope: api:write.

Path parameters

organizationIdstringRequired

Organization that owns the permission groups.

minLength: 1

groupIdstringRequired

Permission group identifier.

minLength: 1

Request body

Required

Group fields and restriction keys to change; supplied lists replace their contents.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Group fields and restriction keys to change; supplied lists replace their contents.

5 fields

namestring

Group name, unique within the organization.

minLength: 1
maxLength: 100

descriptionvalue

Group description. Null or an empty string clears it; omission leaves it unchanged.

Schema details

Any of

Option 1string

maxLength: 500

Option 2null

configobject

Patch of group settings. Omitted keys remain unchanged; each supplied array replaces that entire list.

45 fields

allowedIntegrationsvalue

Integrations and blocks are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

Option 2null

allowedModelProvidersvalue

Model providers are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

Option 2null

deniedModelsarray

Models listed in this list are blocked.

Schema details

Array itemstring

deniedToolsarray

Integration tools listed in this list are blocked.

Schema details

Array itemstring

hideTraceSpansboolean

Withhold per-block trace spans from logs and from the API.

hideKnowledgeBaseTabboolean

Revoke the Knowledge Base module. Members cannot open, search, or query any knowledge base.

hideTablesTabboolean

Revoke the Tables module. Members cannot read or write any table.

hideCopilotboolean

Revoke Chat. Members cannot ask Sim to build or edit anything.

hideIntegrationsTabboolean

Revoke integration connections. Members cannot view, add, or remove an OAuth connection.

hideSecretsTabboolean

Revoke secrets. Members cannot read, add, or change a workspace environment variable.

hideApiKeysTabboolean

Revoke workspace API keys. Members cannot list, create, or revoke one.

hideInboxTabboolean

Revoke the Sim Mailer inbox. Members cannot read or send mail.

hideFilesTabboolean

Revoke the Files module. Members cannot list, upload, or download workspace files.

disableMcpToolsboolean

Block agents from calling MCP tools.

disableCustomToolsboolean

Block agents from calling user-defined custom tools.

disableSkillsboolean

Block agents from loading skills.

disableInvitationsboolean

Prevent inviting anyone to a workspace or to the organization.

disablePublicApiboolean

Revoke public API access. Calls to a deployed workflow are refused.

disablePublicFileSharingboolean

Revoke public file sharing. Members cannot create a share link.

allowedFileShareAuthTypesvalue

Public file-share authentication is limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

enum: ["public","password","email","sso"]

Option 2null

hideDeployApiboolean

Prevent deploying a workflow as an API endpoint.

hideDeployMcpboolean

Prevent exposing a workflow as an MCP server.

hideDeployChatbotboolean

Prevent deploying a workflow as a chat.

allowedChatDeployAuthTypesvalue

Chat deployment authentication is limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

enum: ["public","password","email","sso"]

Option 2null

disablePersonalApiKeysboolean

Prevent members from using a personal API key against this workspace.

disableLogExportboolean

Prevent downloading execution logs as a CSV.

hideCostInfoboolean

Withhold execution cost. Logs and member exports omit cost and token spend; organization-level data drains, configurable by org admins only, are not projected.

disableKnowledgeBaseCreationboolean

Prevent creating knowledge bases, leaving existing ones queryable.

disableKnowledgeBaseFileUploadboolean

Prevent uploading local documents, leaving sanctioned connectors as the only source.

allowedKnowledgeConnectorsvalue

Knowledge base connectors are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

Option 2null

disableTableCreationboolean

Prevent creating tables, leaving existing ones usable.

disableTableExportboolean

Prevent downloading a whole table as CSV or JSON.

disableBulkFileDownloadboolean

Prevent downloading folders as an archive.

disablePersonalCredentialsboolean

Prevent connecting personal credentials, leaving only workspace-shared ones.

disableWorkspaceCreationboolean

Prevent creating new workspaces, which no existing group would govern. Read from the organization's default group, because creating a workspace names none.

hideOrgMemberDirectoryboolean

Withhold the member directory. Members cannot see the names or email addresses of other members. Read from the organization's default group, because the directory belongs to the organization and names no workspace.

disableCliAccessboolean

Prevent approving a CLI login or using Sim CLI OAuth tokens for the public API. A login naming one of this group's workspaces is refused; an account-level login names none, so it is read from the organization's default group.

disableWebhookTriggersboolean

Prevent making a workflow reachable from an inbound webhook.

disableToolAutoApprovalboolean

Prevent silencing a tool confirmation, so every call is confirmed again.

hideSandboxesTabboolean

Revoke the Sandboxes module. Members cannot view, create, or change a workspace sandbox.

disableOAuthAppAccessboolean

Prevent OAuth apps from accessing this group's workspaces. The organization's default group also governs authorizing apps and refreshing their access.

disableKnowledgeBaseExportboolean

Prevent downloading a whole knowledge base as an archive.

deniedPartialAccessProjectIssuesarray

Issues in the listed Projects are unavailable to teammates without access to every active environment.

Schema details

Array itemstring

minLength: 1
maxLength: 255

defaultAgentModelvalue

Default model for new Agent blocks. Null uses the platform default.

Schema details

Any of

Option 1string

minLength: 1

Option 2null

deniedAccessRequestsarray

Access requests are unavailable for the listed canonical target keys when access is restricted.

Schema details

Array itemstring

minLength: 1
maxLength: 1024

Additional properties are not allowed.

isDefaultboolean

Whether the group is the organization default. Only one group can be the default.

workspaceIdsarray

Workspace identifiers for a non-default group. Required on creation; an empty update makes the group inactive.

maxItems: 500

Schema details

Array itemstring

minLength: 1

Additional properties are not allowed.

Request example 1

json

{
  "description": "Restricted workspace access"
}

Responses

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

The updated group with resolved settings and workspace scope.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

The updated group with resolved settings and workspace scope.

1 field

dataobjectRequired

Response data.

11 fields

idstringRequired

Permission group identifier.

organizationIdstringRequired

Organization that owns the group.

namestringRequired

Group name, unique within the organization.

descriptionvalueRequired

Optional description of the group.

Schema details

Any of

Option 1string

Option 2null

configobjectRequired

Resolved group settings. True disables a boolean capability; null allowlists permit every value and empty allowlists permit none. defaultAgentModel selects the default for new Agent blocks without restricting model selection.

45 fields

allowedIntegrationsvalueRequired

Integrations and blocks are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

Option 2null

allowedModelProvidersvalueRequired

Model providers are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

Option 2null

deniedModelsarrayRequired

Models listed in this list are blocked.

default: []

Schema details

Array itemstring

deniedToolsarrayRequired

Integration tools listed in this list are blocked.

default: []

Schema details

Array itemstring

hideTraceSpansbooleanRequired

Withhold per-block trace spans from logs and from the API.

hideKnowledgeBaseTabbooleanRequired

Revoke the Knowledge Base module. Members cannot open, search, or query any knowledge base.

hideTablesTabbooleanRequired

Revoke the Tables module. Members cannot read or write any table.

hideCopilotbooleanRequired

Revoke Chat. Members cannot ask Sim to build or edit anything.

hideIntegrationsTabbooleanRequired

Revoke integration connections. Members cannot view, add, or remove an OAuth connection.

hideSecretsTabbooleanRequired

Revoke secrets. Members cannot read, add, or change a workspace environment variable.

hideApiKeysTabbooleanRequired

Revoke workspace API keys. Members cannot list, create, or revoke one.

hideInboxTabbooleanRequired

Revoke the Sim Mailer inbox. Members cannot read or send mail.

hideFilesTabbooleanRequired

Revoke the Files module. Members cannot list, upload, or download workspace files.

disableMcpToolsbooleanRequired

Block agents from calling MCP tools.

disableCustomToolsbooleanRequired

Block agents from calling user-defined custom tools.

disableSkillsbooleanRequired

Block agents from loading skills.

disableInvitationsbooleanRequired

Prevent inviting anyone to a workspace or to the organization.

disablePublicApibooleanRequired

Revoke public API access. Calls to a deployed workflow are refused.

disablePublicFileSharingbooleanRequired

Revoke public file sharing. Members cannot create a share link.

allowedFileShareAuthTypesvalueRequired

Public file-share authentication is limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

enum: ["public","password","email","sso"]

Option 2null

hideDeployApibooleanRequired

Prevent deploying a workflow as an API endpoint.

hideDeployMcpbooleanRequired

Prevent exposing a workflow as an MCP server.

hideDeployChatbotbooleanRequired

Prevent deploying a workflow as a chat.

allowedChatDeployAuthTypesvalueRequired

Chat deployment authentication is limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

enum: ["public","password","email","sso"]

Option 2null

disablePersonalApiKeysbooleanRequired

Prevent members from using a personal API key against this workspace.

disableLogExportbooleanRequired

Prevent downloading execution logs as a CSV.

hideCostInfobooleanRequired

Withhold execution cost. Logs and member exports omit cost and token spend; organization-level data drains, configurable by org admins only, are not projected.

disableKnowledgeBaseCreationbooleanRequired

Prevent creating knowledge bases, leaving existing ones queryable.

disableKnowledgeBaseFileUploadbooleanRequired

Prevent uploading local documents, leaving sanctioned connectors as the only source.

allowedKnowledgeConnectorsvalueRequired

Knowledge base connectors are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array

Schema details

Array itemstring

Option 2null

disableTableCreationbooleanRequired

Prevent creating tables, leaving existing ones usable.

disableTableExportbooleanRequired

Prevent downloading a whole table as CSV or JSON.

disableBulkFileDownloadbooleanRequired

Prevent downloading folders as an archive.

disablePersonalCredentialsbooleanRequired

Prevent connecting personal credentials, leaving only workspace-shared ones.

disableWorkspaceCreationbooleanRequired

Prevent creating new workspaces, which no existing group would govern. Read from the organization's default group, because creating a workspace names none.

hideOrgMemberDirectorybooleanRequired

disableCliAccessbooleanRequired

disableWebhookTriggersbooleanRequired

Prevent making a workflow reachable from an inbound webhook.

disableToolAutoApprovalbooleanRequired

Prevent silencing a tool confirmation, so every call is confirmed again.

hideSandboxesTabbooleanRequired

Revoke the Sandboxes module. Members cannot view, create, or change a workspace sandbox.

disableOAuthAppAccessbooleanRequired

Prevent OAuth apps from accessing this group's workspaces. The organization's default group also governs authorizing apps and refreshing their access.

disableKnowledgeBaseExportbooleanRequired

Prevent downloading a whole knowledge base as an archive.

deniedPartialAccessProjectIssuesarrayRequired

Issues in the listed Projects are unavailable to teammates without access to every active environment.

default: []

Schema details

Array itemstring

minLength: 1
maxLength: 255

defaultAgentModelvalueRequired

Default model for new Agent blocks. Null uses the platform default.

default: null

Schema details

Any of

Option 1string

minLength: 1

Option 2null

deniedAccessRequestsarrayRequired

Access requests are unavailable for the listed canonical target keys when access is restricted.

default: []

Schema details

Array itemstring

minLength: 1
maxLength: 1024

Additional properties are not allowed.

isDefaultbooleanRequired

Whether this is the organization fallback group. It governs a human caller with no applicable workspace-specific group; its own membership assignments do not limit its audience. Organization-level actions use the default group.

membershipModestringRequired

When no explicit assignments exist, an inherit group governs every member in its targeted workspaces. An empty explicit group, including a SCIM-managed group, governs nobody.

workspaceIdsarrayRequired

Workspaces governed by a non-default group. Empty for the default group.

Schema details

Array itemstring

createdBystringRequired

User who created the group.

createdAtstringRequired

When the group was created.

format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

updatedAtstringRequired

When the group was last updated.

format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

Additional properties are not allowed.

Response example 1

json

{
  "data": {
    "id": "group-123",
    "organizationId": "org-123",
    "name": "Restricted",
    "description": null,
    "config": {
      "allowedIntegrations": null,
      "allowedModelProviders": null,
      "deniedModels": [],
      "deniedTools": [],
      "hideTraceSpans": false,
      "hideKnowledgeBaseTab": false,
      "hideTablesTab": false,
      "hideCopilot": false,
      "hideIntegrationsTab": false,
      "hideSecretsTab": false,
      "hideApiKeysTab": false,
      "hideInboxTab": false,
      "hideFilesTab": false,
      "disableMcpTools": false,
      "disableCustomTools": false,
      "disableSkills": false,
      "disableInvitations": false,
      "disablePublicApi": false,
      "disablePublicFileSharing": false,
      "allowedFileShareAuthTypes": null,
      "hideDeployApi": false,
      "hideDeployMcp": false,
      "hideDeployChatbot": false,
      "allowedChatDeployAuthTypes": null,
      "disablePersonalApiKeys": false,
      "disableLogExport": false,
      "hideCostInfo": false,
      "disableKnowledgeBaseCreation": false,
      "disableKnowledgeBaseFileUpload": false,
      "allowedKnowledgeConnectors": null,
      "disableTableCreation": false,
      "disableTableExport": false,
      "disableBulkFileDownload": false,
      "disablePersonalCredentials": false,
      "disableWorkspaceCreation": false,
      "hideOrgMemberDirectory": false,
      "disableCliAccess": false,
      "disableWebhookTriggers": false,
      "disableToolAutoApproval": false,
      "hideSandboxesTab": false,
      "disableOAuthAppAccess": false,
      "disableKnowledgeBaseExport": false,
      "deniedPartialAccessProjectIssues": [],
      "defaultAgentModel": null,
      "deniedAccessRequests": []
    },
    "isDefault": false,
    "membershipMode": "inherit",
    "workspaceIds": [
      "workspace-123"
    ],
    "createdBy": "admin-123",
    "createdAt": "2026-06-01T09:00:00.000Z",
    "updatedAt": "2026-06-01T09:00:00.000Z"
  }
}

Response headers

X-RateLimit-Limitinteger

Maximum requests allowed in the current window.

minimum: 0
maximum: 9007199254740991

X-RateLimit-Remaininginteger

Requests remaining in the current window.

minimum: 0
maximum: 9007199254740991

X-RateLimit-Resetstring

ISO 8601 timestamp when the current rate-limit window resets.

format: date-time
pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

The request is invalid. This includes a query parameter sent with no value (?limit=, ?search=), which is rejected rather than read as zero, empty, or the parameter default — omit the parameter instead.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "Invalid request"
  }
}

The API credential is missing or invalid.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required"
  }
}

The caller lacks the rights this operation requires. When the cause is one a caller can act on, error.details.code names it. A resource in a workspace the caller cannot reach at all answers 404 instead, so absence and denial are indistinguishable.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "FORBIDDEN",
    "message": "Insufficient workspace permissions",
    "details": {
      "code": "INSUFFICIENT_WORKSPACE_ROLE"
    }
  }
}

The requested resource was not found.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "NOT_FOUND",
    "message": "Not found"
  }
}

The request conflicts with current resource state.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "CONFLICT",
    "message": "The request conflicts with the current state of the resource"
  }
}

The request, or a resource collection it must materialize, exceeds the allowed size: an oversized request body, a generated artifact past the download ceiling, or a workspace folder tree too large to load in full.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "PAYLOAD_TOO_LARGE",
    "message": "Request body is too large"
  }
}

The request uses an unsupported media type.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "UNSUPPORTED_MEDIA_TYPE",
    "message": "Request body must be sent as application/json"
  }
}

The caller exceeded the request rate limit.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "RATE_LIMITED",
    "message": "API rate limit exceeded",
    "details": {
      "retryAfter": "2026-01-01T00:00:30.000Z"
    }
  }
}

Response headers

Retry-Afterinteger

Seconds to wait before retrying, sent on 429 and 503. Add jitter rather than retrying at exactly this offset.

minimum: 0
maximum: 9007199254740991

An unexpected server error occurred.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "Internal server error"
  }
}

A required service is temporarily unavailable. When present, Retry-After gives the minimum seconds to wait; add jitter before retrying. Check operation-specific guidance before repeating a change after an uncertain response.

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

object

Canonical error envelope returned by the public v2 API.

1 field

errorobjectRequired

Canonical error details.

3 fields

codestringRequired

Stable machine-readable error code.

messagestringRequired

Human-readable explanation of the error.

detailsvalue

Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.

Schema details

Any of

Option 1object

Machine-readable cause and optional context for an actionable 403 response.

1 field

codestringRequired

Stable cause code for an actionable 403 response.

enum: ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]

Additional propertiesvalue

Additional context for this refusal.

Option 2value

Other structured context defined by the specific error.

Additional properties are not allowed.

Example

{
  "error": {
    "code": "SERVICE_UNAVAILABLE",
    "message": "Service temporarily unavailable"
  }
}

Response headers

Retry-Afterinteger

Seconds to wait before retrying, sent on 429 and 503. Add jitter rather than retrying at exactly this offset.

minimum: 0
maximum: 9007199254740991

Suggest an edit

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

Request

curl --request PATCH 'https://www.sim.ai/api/v2/organizations/string/permission-groups/string' \
  --header 'X-API-Key: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
  "description": "Restricted workspace access"
}'

const response = await fetch("https://www.sim.ai/api/v2/organizations/string/permission-groups/string", {
  "method": "PATCH",
  "headers": {
    "X-API-Key": "YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  "body": "{\n  \"description\": \"Restricted workspace access\"\n}"
});
if (!response.ok) throw new Error(`HTTP ${response.status}`);
const result = await response.json();

import requests

response = requests.request(
    "PATCH",
    "https://www.sim.ai/api/v2/organizations/string/permission-groups/string",
    headers={
  "X-API-Key": "YOUR_API_KEY",
  "Content-Type": "application/json"
},
    data="{\n  \"description\": \"Restricted workspace access\"\n}",
)
response.raise_for_status()
result = response.json()

package main

import (
  "io"
  "net/http"
  "os"
  "strings"
)

func check(err error) {
  if err != nil { panic(err) }
}

func must[T any](value T, err error) T {
  check(err)
  return value
}

func main() {

  request := must(http.NewRequest("PATCH", "https://www.sim.ai/api/v2/organizations/string/permission-groups/string", strings.NewReader("{\n  \"description\": \"Restricted workspace access\"\n}")))
  request.Header.Set("X-API-Key", "YOUR_API_KEY")
  request.Header.Set("Content-Type", "application/json")
  response := must(http.DefaultClient.Do(request))
  defer response.Body.Close()
  if response.StatusCode >= 400 { panic(response.Status) }
  must(io.Copy(os.Stdout, response.Body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
  public static void main(String[] args) throws Exception {
    var builder = HttpRequest.newBuilder(URI.create("https://www.sim.ai/api/v2/organizations/string/permission-groups/string"));
    builder.header("X-API-Key", "YOUR_API_KEY");
    builder.header("Content-Type", "application/json");
    var request = builder.method("PATCH", HttpRequest.BodyPublishers.ofString("{\n  \"description\": \"Restricted workspace access\"\n}")).build();
    var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofInputStream());
    try (var body = response.body()) {
      if (response.statusCode() >= 400) throw new IllegalStateException("HTTP " + response.statusCode());
      body.transferTo(System.out);
    }
  }
}

using System;
using System.IO;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();
using var request = new HttpRequestMessage(new HttpMethod("PATCH"), "https://www.sim.ai/api/v2/organizations/string/permission-groups/string");
request.Content = new StringContent("{\n  \"description\": \"Restricted workspace access\"\n}", Encoding.UTF8);
request.Headers.TryAddWithoutValidation("X-API-Key", "YOUR_API_KEY");
request.Content!.Headers.ContentType = System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json");
using var response = await client.SendAsync(request, HttpCompletionOption.ResponseHeadersRead);
response.EnsureSuccessStatusCode();
await response.Content.CopyToAsync(Console.OpenStandardOutput());

@layer base { .docs-root [data-docs-tab-panel][hidden] { display: block !important; } } .docs-root [data-docs-tabs-root] [role="tablist"], .docs-root [data-docs-tabs-select] { display: none; }

Response

{
  "data": {
    "id": "group-123",
    "organizationId": "org-123",
    "name": "Restricted",
    "description": null,
    "config": {
      "allowedIntegrations": null,
      "allowedModelProviders": null,
      "deniedModels": [],
      "deniedTools": [],
      "hideTraceSpans": false,
      "hideKnowledgeBaseTab": false,
      "hideTablesTab": false,
      "hideCopilot": false,
      "hideIntegrationsTab": false,
      "hideSecretsTab": false,
      "hideApiKeysTab": false,
      "hideInboxTab": false,
      "hideFilesTab": false,
      "disableMcpTools": false,
      "disableCustomTools": false,
      "disableSkills": false,
      "disableInvitations": false,
      "disablePublicApi": false,
      "disablePublicFileSharing": false,
      "allowedFileShareAuthTypes": null,
      "hideDeployApi": false,
      "hideDeployMcp": false,
      "hideDeployChatbot": false,
      "allowedChatDeployAuthTypes": null,
      "disablePersonalApiKeys": false,
      "disableLogExport": false,
      "hideCostInfo": false,
      "disableKnowledgeBaseCreation": false,
      "disableKnowledgeBaseFileUpload": false,
      "allowedKnowledgeConnectors": null,
      "disableTableCreation": false,
      "disableTableExport": false,
      "disableBulkFileDownload": false,
      "disablePersonalCredentials": false,
      "disableWorkspaceCreation": false,
      "hideOrgMemberDirectory": false,
      "disableCliAccess": false,
      "disableWebhookTriggers": false,
      "disableToolAutoApproval": false,
      "hideSandboxesTab": false,
      "disableOAuthAppAccess": false,
      "disableKnowledgeBaseExport": false,
      "deniedPartialAccessProjectIssues": [],
      "defaultAgentModel": null,
      "deniedAccessRequests": []
    },
    "isDefault": false,
    "membershipMode": "inherit",
    "workspaceIds": [
      "workspace-123"
    ],
    "createdBy": "admin-123",
    "createdAt": "2026-06-01T09:00:00.000Z",
    "updatedAt": "2026-06-01T09:00:00.000Z"
  }
}

{
  "error": {
    "code": "FORBIDDEN",
    "message": "Insufficient workspace permissions",
    "details": {
      "code": "INSUFFICIENT_WORKSPACE_ROLE"
    }
  }
}

{
  "error": {
    "code": "RATE_LIMITED",
    "message": "API rate limit exceeded",
    "details": {
      "retryAfter": "2026-01-01T00:00:30.000Z"
    }
  }
}

OpenAPI document ↗Download the specification

Authentication

Path parameters

Request body

Request example 1

Responses

200

Response example 1

Response headers

400

401

403

404

409

413

415

429

Response headers

500

503

Response headers