/api/v2/workspaces/{workspaceId}/fork/push/previewPreview changes from this workspace into the other workspace along a direct fork edge. Requires Admin access to both workspaces. The plan lists workflows to create, replace, or archive; replacements overwrite target drafts with the source deployment. Proposed mappings are not saved. Dependent choices use source workflow, block, and field IDs. Billing-enabled deployments require Enterprise. Billing-disabled deployments require forking to be enabled by deployment feature configuration, such as FORKING_ENABLED. Workspace API keys return 403; use a personal API key or scoped OAuth token.
OAuth scope: api:write.
Authentication
Send a personal or workspace API key in X-API-Key. See key types and access; operations that reject workspace keys say so in their description.
Send X-API-Key in the request header.
Alternatively
Send a Sim OAuth access token in Authorization: Bearer. See OAuth authentication and scopes.
Authorization: Bearer YOUR_ACCESS_TOKEN
Required scopes: api:write
OAuth flows
OAuth scope: api:write.
Path parameters
Explicit current workspace scope.
- minLength
- 1
- maxLength
- 128
Request body
RequiredOther workspace and proposed source-to-target sync choices.
Other workspace and proposed source-to-target sync choices.
6 fields
Workspace on the other side of the direct fork edge.
- minLength
- 1
- maxLength
- 128
Proposed mapping entries addressed by resource type and sourceId. Preview does not save them; apply commits them with the sync.
- maxItems
- 5000
Schema details
3 fields
Resource type stored on the canonical parent/child edge.
- enum
- ["oauth_credential","service_account_credential","env_var","table","knowledge_base","file","file_folder","mcp_server","custom_block","custom_tool","skill","sandbox"]
Source resource identifier in the canonical source workspace.
- minLength
- 1
- maxLength
- 4096
Authorized destination identifier, or null to clear the mapping.
Schema details
Any of
- minLength
- 1
- maxLength
- 4096
Additional properties are not allowed.
Destination-specific choices addressed by source workflow ID, source block ID, and field key. Omission keeps saved overrides; an explicit empty array clears them.
- maxItems
- 2000
Schema details
4 fields
Workflow identifier in the source workspace.
- minLength
- 1
Block identifier in the source workflow.
- minLength
- 1
- maxLength
- 256
Registered source field key, including the tool index for nested Agent fields.
- minLength
- 1
- maxLength
- 1024
Destination value for the registered dependent field.
- maxLength
- 65536
Additional properties are not allowed.
Explicit source resources to copy before syncing the workflows.
6 fields
Source knowledge base identifiers whose documents and content are copied.
- maxItems
- 2000
Schema details
- minLength
- 1
Source table identifiers whose schemas and rows are copied.
- maxItems
- 2000
Schema details
- minLength
- 1
Source custom tool identifiers to copy.
- maxItems
- 2000
Schema details
- minLength
- 1
Source skill identifiers to copy.
- maxItems
- 2000
Schema details
- minLength
- 1
Workspace file storage keys to copy.
- maxItems
- 2000
Schema details
- minLength
- 1
External MCP server identifiers to copy; OAuth connections require authorization in the destination.
- maxItems
- 2000
Schema details
- minLength
- 1
Additional properties are not allowed.
Source-deleted references explicitly acknowledged for removal; live source references cannot be dropped.
- maxItems
- 2000
Schema details
2 fields
Resource or operation kind.
- enum
- ["credential","env-var","knowledge-base","knowledge-document","table","file","file-folder","mcp-server","custom-tool","custom-block","skill","sandbox"]
Source resource identifier in the canonical source workspace.
- minLength
- 1
- maxLength
- 4096
Additional properties are not allowed.
Public trigger path choices from preview.triggerSlots, addressed by source workflow and block IDs. Duplicate or unavailable choices are rejected.
- maxItems
- 500
Schema details
3 fields
Workflow identifier in the source workspace.
- minLength
- 1
Source trigger block identifier from the sync preview.
- minLength
- 1
- maxLength
- 256
An adoptable path offered for this trigger, or null to allocate a new path.
Schema details
Any of
- minLength
- 1
- maxLength
- 4096
Additional properties are not allowed.
Additional properties are not allowed.
Responses
200
Current-to-other workflow actions, required choices, and preview fingerprint.
Current-to-other workflow actions, required choices, and preview fingerprint.
1 field
Response data.
10 fields
Fingerprint to submit when applying this preview with the same choices. Preview again after changing a choice.
- pattern
- ^[a-f0-9]{64}$
Canonical workspace the workflows and resources are copied from.
- minLength
- 1
- maxLength
- 128
Canonical workspace receiving the changes.
- minLength
- 1
- maxLength
- 128
Whether required bindings, configuration, and sync blockers are resolved. This does not mean the target is already deployed.
Eligible workflows and their planned actions.
- maxItems
- 2000
Schema details
5 fields
Planned workflow creation, replacement, or archival.
- enum
- ["create","replace","archive"]
Workflow identifier in the source workspace.
- minLength
- 1
Existing target workflow identifier; absent when apply will create a new target.
- minLength
- 1
Display name of the workflow or workspace.
- maxLength
- 1024
Last successfully synced source deployment compared with the source deployment pinned by this preview. Absent for archive actions.
Schema details
Exactly one of
3 fields
Both exact source snapshots are available.
- const
- available
Source deployment last successfully synced to this destination.
2 fields
Exact source deployment snapshot identifier.
- minLength
- 1
Saved version number in the source workflow.
- minimum
- 1
- maximum
- 2147483647
Additional properties are not allowed.
Pinned source deployment that this sync would copy.
2 fields
Exact source deployment snapshot identifier.
- minLength
- 1
Saved version number in the source workflow.
- minimum
- 1
- maximum
- 2147483647
Additional properties are not allowed.
Additional properties are not allowed.
3 fields
The source baseline cannot be compared.
- const
- unavailable
New destination workflow, no recorded successful sync, or deleted baseline snapshot.
- enum
- ["new_workflow","no_baseline","missing_baseline"]
Pinned source deployment that this sync would copy.
2 fields
Exact source deployment snapshot identifier.
- minLength
- 1
Saved version number in the source workflow.
- minimum
- 1
- maximum
- 2147483647
Additional properties are not allowed.
Additional properties are not allowed.
Additional properties are not allowed.
Source references that still require destination mappings or explicit copy choices.
- maxItems
- 10000
Schema details
4 fields
Resource or operation kind.
- maxLength
- 256
Source resource identifier in the canonical source workspace.
- maxLength
- 4096
Display name of the affected source block.
- maxLength
- 1024
Structured explanation of the unresolved binding.
- maxLength
- 256
Additional properties are not allowed.
Dependent fields that may need destination-specific values.
- maxItems
- 10000
Schema details
13 fields
Workflow identifier in the source workspace.
- minLength
- 1
Block identifier in the source workflow.
- maxLength
- 256
Registered source field key, including the tool index for nested Agent fields.
- maxLength
- 1024
Human-readable configuration field label.
- maxLength
- 1024
Whether the reference or configuration is required for this operation.
Persisted sync override or proposed override; empty when neither is configured.
- maxLength
- 65536
Whether the field accepts comma-separated selections.
Registered selector key for discovering this field’s options.
- maxLength
- 256
Workspace scope for selector discovery: source for a parent being copied, otherwise destination.
- minLength
- 1
- maxLength
- 128
Allowlisted selector dependencies scoped to discoveryWorkspaceId.
Schema details
- maxLength
- 4096
Resource kind that owns this dependent configuration.
- enum
- ["credential","env-var","knowledge-base","knowledge-document","table","file","file-folder","mcp-server","custom-tool","custom-block","skill","sandbox"]
Source identifier of the parent resource being mapped.
- maxLength
- 4096
Selector context key supplied by the mapped parent resource.
- maxLength
- 256
Additional properties are not allowed.
Target workflows explicitly excluded from sync.
- maxItems
- 1000
Schema details
2 fields
Resource identifier.
- minLength
- 1
Display name of the workflow or workspace.
- maxLength
- 1024
Additional properties are not allowed.
Source triggers and the target paths available for explicit adoption choices.
- maxItems
- 10000
Schema details
7 fields
Workflow identifier in the source workspace.
- minLength
- 1
Stable source trigger block identifier to use in trigger mappings.
- minLength
- 1
- maxLength
- 256
Display name of the source trigger block.
- maxLength
- 1024
Display name of the source workflow.
- maxLength
- 1024
Existing target trigger path, preserved automatically and not configurable.
Schema details
Any of
- maxLength
- 4096
Retiring paths in the same target workflow with a compatible trigger provider.
- maxItems
- 1000
Schema details
- minLength
- 1
- maxLength
- 4096
Default adoption when ownPath is null; null then allocates a new path.
Schema details
Any of
- maxLength
- 4096
Additional properties are not allowed.
Retiring target trigger URLs no arriving trigger adopts.
- maxItems
- 1000
Schema details
2 fields
Name of the affected workflow.
- maxLength
- 1024
Public trigger path that stops serving after this sync.
- maxLength
- 4096
Additional properties are not allowed.
Additional properties are not allowed.
Additional properties are not allowed.
400
The request is invalid. This includes a query parameter sent with no value (?limit=, ?search=), which is rejected rather than read as zero, empty, or the parameter default — omit the parameter instead.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
401
The API credential is missing or invalid.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
403
The caller lacks the rights this operation requires. When the cause is one a caller can act on, error.details.code names it. A resource in a workspace the caller cannot reach at all answers 404 instead, so absence and denial are indistinguishable.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
404
The requested resource was not found.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
409
The request conflicts with current resource state.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
413
The request, or a resource collection it must materialize, exceeds the allowed size: an oversized request body, a generated artifact past the download ceiling, or a workspace folder tree too large to load in full.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
429
The caller exceeded the request rate limit.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
Response headers
Seconds to wait before retrying, sent on 429 and 503. Add jitter rather than retrying at exactly this offset.
- minimum
- 0
- maximum
- 9007199254740991
500
An unexpected server error occurred.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
503
A required service is temporarily unavailable. When present, Retry-After gives the minimum seconds to wait; add jitter before retrying. Check operation-specific guidance before repeating a change after an uncertain response.
Canonical error envelope returned by the public v2 API.
1 field
Canonical error details.
3 fields
Stable machine-readable error code.
Human-readable explanation of the error.
Structured error context whose keys depend on the error. Actionable 403 responses use the V2ActionableForbiddenDetails shape; validation failures may return issue arrays instead.
Schema details
Any of
Machine-readable cause and optional context for an actionable 403 response.
1 field
Stable cause code for an actionable 403 response.
- enum
- ["INSUFFICIENT_WORKSPACE_ROLE","PERSONAL_API_KEYS_DISABLED","WORKSPACE_KEY_OPERATION_NOT_PERMITTED","PRINCIPAL_KIND_NOT_PERMITTED","ORGANIZATION_MEMBERSHIP_REQUIRED","ORGANIZATION_ADMIN_REQUIRED","ENTERPRISE_PLAN_REQUIRED","SSO_DISABLED","SSO_DOMAIN_NOT_VERIFIED","SSO_PROVIDER_LIMIT_REACHED","ORGANIZATION_PLAN_REQUIRED","AUDIT_LOGS_DISABLED","ACCESS_REQUESTS_DISABLED","ACCESS_REQUEST_ORGANIZATION_REQUIRED","SKILL_EDITOR_ACCESS_REQUIRED","SECRET_ADMIN_ACCESS_REQUIRED","WORKSPACE_RESOURCE_LIMIT_REACHED","PUBLIC_SHARING_NOT_ALLOWED","CREDENTIAL_ADMIN_ACCESS_REQUIRED","MCP_SERVER_URL_NOT_ALLOWED","WORKSPACE_PLAN_CAPABILITY_REQUIRED","CHAT_AUTH_MODE_NOT_PERMITTED","CONNECTOR_MANAGED_RESOURCE_READ_ONLY","PERMISSION_GROUP_CAPABILITY_BLOCKED","INTEGRATION_NOT_ALLOWED","INSUFFICIENT_SCOPE","SCIM_MANAGED_MEMBERSHIP"]
Additional context for this refusal.
Other structured context defined by the specific error.
Additional properties are not allowed.
Additional properties are not allowed.
Response headers
Seconds to wait before retrying, sent on 429 and 503. Add jitter rather than retrying at exactly this offset.
- minimum
- 0
- maximum
- 9007199254740991