Skip to content
Try for free
On this page

Workspaces

Get workspace permission config

Get the acting user's governing permission group and configuration for a workspace they can access. This describes permission-group restrictions, not the user's workspace role. Group and config are null when no group governs the caller; entitled indicates whether organization permission governance is active. Workspace API keys return `403`; use a personal API key or scoped OAuth token. OAuth scope: `api:read`.

GET/api/v2/workspaces/{workspaceId}/permission-config

Get the acting user's governing permission group and configuration for a workspace they can access. This describes permission-group restrictions, not the user's workspace role. Group and config are null when no group governs the caller; entitled indicates whether organization permission governance is active. Workspace API keys return 403; use a personal API key or scoped OAuth token.

OAuth scope: api:read.

Authentication

Send a personal or workspace API key in X-API-Key. See key types and access; operations that reject workspace keys say so in their description.

Send X-API-Key in the request header.

Alternatively

Send a Sim OAuth access token in Authorization: Bearer. See OAuth authentication and scopes.

Authorization: Bearer YOUR_ACCESS_TOKEN

Required scopes: api:read

OAuth flows
json
{
  "authorizationCode": {
    "authorizationUrl": "https://www.sim.ai/api/auth/oauth2/authorize",
    "tokenUrl": "https://www.sim.ai/api/auth/oauth2/token",
    "refreshUrl": "https://www.sim.ai/api/auth/oauth2/token",
    "scopes": {
      "api:read": "Read your workspaces, workflows, files, tables, and logs",
      "api:write": "Read, create, change, run, and delete resources in your workspaces",
      "offline_access": "Stay signed in without asking again"
    }
  }
}

OAuth scope: api:read.

Path parameters

workspaceIdstringRequired

Unique workspace identifier.

minLength
1
maxLength
128

Responses

200

The caller’s effective permission-group configuration.

object

Configuration for the acting caller only.

1 field
dataobjectRequired

Response data.

6 fields
permissionGroupIdvalueRequired

Identifier of the group governing the caller; null when no group applies.

Schema details

Any of

Option 1string
Option 2null
groupNamevalueRequired

Name of the governing permission group.

Schema details

Any of

Option 1string
Option 2null
configvalueRequired

Effective group settings. True disables a boolean capability; null allowlists allow all values and empty allowlists allow none. Null config means no group applies.

Schema details

Any of

Option 1object
45 fields
allowedIntegrationsvalueRequired

Integrations and blocks are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array
Schema details
Array itemstring
Option 2null
allowedModelProvidersvalueRequired

Model providers are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array
Schema details
Array itemstring
Option 2null
deniedModelsarrayRequired

Models listed in this list are blocked.

default
[]
Schema details
Array itemstring
deniedToolsarrayRequired

Integration tools listed in this list are blocked.

default
[]
Schema details
Array itemstring
hideTraceSpansbooleanRequired

Withhold per-block trace spans from logs and from the API.

hideKnowledgeBaseTabbooleanRequired

Revoke the Knowledge Base module. Members cannot open, search, or query any knowledge base.

hideTablesTabbooleanRequired

Revoke the Tables module. Members cannot read or write any table.

hideCopilotbooleanRequired

Revoke Chat. Members cannot ask Sim to build or edit anything.

hideIntegrationsTabbooleanRequired

Revoke integration connections. Members cannot view, add, or remove an OAuth connection.

hideSecretsTabbooleanRequired

Revoke secrets. Members cannot read, add, or change a workspace environment variable.

hideApiKeysTabbooleanRequired

Revoke workspace API keys. Members cannot list, create, or revoke one.

hideInboxTabbooleanRequired

Revoke the Sim Mailer inbox. Members cannot read or send mail.

hideFilesTabbooleanRequired

Revoke the Files module. Members cannot list, upload, or download workspace files.

disableMcpToolsbooleanRequired

Block agents from calling MCP tools.

disableCustomToolsbooleanRequired

Block agents from calling user-defined custom tools.

disableSkillsbooleanRequired

Block agents from loading skills.

disableInvitationsbooleanRequired

Prevent inviting anyone to a workspace or to the organization.

disablePublicApibooleanRequired

Revoke public API access. Calls to a deployed workflow are refused.

disablePublicFileSharingbooleanRequired

Revoke public file sharing. Members cannot create a share link.

allowedFileShareAuthTypesvalueRequired

Public file-share authentication is limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array
Schema details
Array itemstring
enum
["public","password","email","sso"]
Option 2null
hideDeployApibooleanRequired

Prevent deploying a workflow as an API endpoint.

hideDeployMcpbooleanRequired

Prevent exposing a workflow as an MCP server.

hideDeployChatbotbooleanRequired

Prevent deploying a workflow as a chat.

allowedChatDeployAuthTypesvalueRequired

Chat deployment authentication is limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array
Schema details
Array itemstring
enum
["public","password","email","sso"]
Option 2null
disablePersonalApiKeysbooleanRequired

Prevent members from using a personal API key against this workspace.

disableLogExportbooleanRequired

Prevent downloading execution logs as a CSV.

hideCostInfobooleanRequired

Withhold execution cost. Logs and member exports omit cost and token spend; organization-level data drains, configurable by org admins only, are not projected.

disableKnowledgeBaseCreationbooleanRequired

Prevent creating knowledge bases, leaving existing ones queryable.

disableKnowledgeBaseFileUploadbooleanRequired

Prevent uploading local documents, leaving sanctioned connectors as the only source.

allowedKnowledgeConnectorsvalueRequired

Knowledge base connectors are limited to this list. Null permits every value; an empty list permits none.

Schema details

Any of

Option 1array
Schema details
Array itemstring
Option 2null
disableTableCreationbooleanRequired

Prevent creating tables, leaving existing ones usable.

disableTableExportbooleanRequired

Prevent downloading a whole table as CSV or JSON.

disableBulkFileDownloadbooleanRequired

Prevent downloading folders as an archive.

disablePersonalCredentialsbooleanRequired

Prevent connecting personal credentials, leaving only workspace-shared ones.

disableWorkspaceCreationbooleanRequired

Prevent creating new workspaces, which no existing group would govern. Read from the organization's default group, because creating a workspace names none.

hideOrgMemberDirectorybooleanRequired

Withhold the member directory. Members cannot see the names or email addresses of other members. Read from the organization's default group, because the directory belongs to the organization and names no workspace.

disableCliAccessbooleanRequired

Prevent approving a CLI login or using Sim CLI OAuth tokens for the public API. A login naming one of this group's workspaces is refused; an account-level login names none, so it is read from the organization's default group.

disableWebhookTriggersbooleanRequired

Prevent making a workflow reachable from an inbound webhook.

disableToolAutoApprovalbooleanRequired

Prevent silencing a tool confirmation, so every call is confirmed again.

hideSandboxesTabbooleanRequired

Revoke the Sandboxes module. Members cannot view, create, or change a workspace sandbox.

disableOAuthAppAccessbooleanRequired

Prevent OAuth apps from accessing this group's workspaces. The organization's default group also governs authorizing apps and refreshing their access.

disableKnowledgeBaseExportbooleanRequired

Prevent downloading a whole knowledge base as an archive.

deniedPartialAccessProjectIssuesarrayRequired

Issues in the listed Projects are unavailable to teammates without access to every active environment.

default
[]
Schema details
Array itemstring
minLength
1
maxLength
255
defaultAgentModelvalueRequired

Default model for new Agent blocks. Null uses the platform default.

default
null
Schema details

Any of

Option 1string
minLength
1
Option 2null
deniedAccessRequestsarrayRequired

Access requests are unavailable for the listed canonical target keys when access is restricted.

default
[]
Schema details
Array itemstring
minLength
1
maxLength
1024

Additional properties are not allowed.

Option 2null
entitledbooleanRequired

Whether organization permission governance is active.

organizationIdvalueRequired

Organization that owns the workspace; null for a personal workspace.

Schema details

Any of

Option 1string
Option 2null
isOrgAdminbooleanRequired

Whether the caller is an owner or administrator of the workspace’s organization.

Additional properties are not allowed.

Additional properties are not allowed.

Response example 1

json
{
  "data": {
    "permissionGroupId": null,
    "groupName": null,
    "config": null,
    "entitled": false,
    "organizationId": null,
    "isOrgAdmin": false
  }
}

Response headers

X-RateLimit-Limitinteger

Maximum requests allowed in the current window.

minimum
0
maximum
9007199254740991
X-RateLimit-Remaininginteger

Requests remaining in the current window.

minimum
0
maximum
9007199254740991
X-RateLimit-Resetstring

ISO 8601 timestamp when the current rate-limit window resets.

format
date-time
pattern
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
Was this helpful?
Suggest an edit