> ## Documentation Index
> Fetch the complete documentation index at: https://cadenya.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# List workspaces
> Every workspace your token can reach. One of the few routes with no workspace in its path.
A [workspace](/docs/guides/api-design) isolates resources: agents, tool sets, memory, secrets, objectives. This endpoint tells you which ones the token in your hand can touch.
```typescript TypeScript theme={null}
const workspaces = await client.workspaces.list();
for await (const w of workspaces) {
console.log(w.metadata.id, w.metadata.name, w.metadata.externalId);
}
// workspace_01KVNB4N15X9F20X40JJNHBJGN Production production
// workspace_01KVNB4N24PCD0VM9M7ACABZV6 Development development
```
```go Go theme={null}
page, err := client.Workspaces.List(ctx, cadenya.WorkspaceListParams{})
for _, w := range page.Items {
fmt.Println(w.Metadata.ID, w.Metadata.Name, w.Metadata.ExternalID)
}
// workspace_01KVNB4N15X9F20X40JJNHBJGN Production production
// workspace_01KVNB4N24PCD0VM9M7ACABZV6 Development development
```
```ruby Ruby theme={null}
page = cadenya.workspaces.list
page.auto_paging_each do |w|
puts "#{w.metadata.id} #{w.metadata.name} #{w.metadata.external_id}"
end
# workspace_01KVNB4N15X9F20X40JJNHBJGN Production production
# workspace_01KVNB4N24PCD0VM9M7ACABZV6 Development development
```
```bash cURL theme={null}
curl "https://api.cadenya.com/v1/workspaces" \
-H "Authorization: Bearer ${CADENYA_API_KEY}"
```
An [API key](/docs/guides/api-design) is account-scoped and reaches only the workspaces it has been granted, which is exactly what this returns.
## Most of the API is workspace-scoped
Sixty-five of the API's eighty-one routes sit under `/v1/workspaces/{workspaceId}/`. Agents, tool sets, objectives, memory, secrets, and schedules all live inside a workspace, which is the isolation boundary between staging and production, or between one tenant and the next.
The rest are account-scoped or identity-scoped:
```
/v1/account the account, billing, admin
/v1/account/api_keys credentials, which are account-scoped
/v1/account/workspaces workspace administration
/v1/account/profiles people and machines
/v1/whoami the profile behind this token
/v1/workspaces this one
```
Reference pages write paths in full. Prose across the guides drops the `/v1/workspaces/{workspaceId}/` prefix for readability, so `POST /objectives` means `POST /v1/workspaces/{workspaceId}/objectives`.
## The workspace segment takes an external ID
Anywhere a Cadenya ID appears, including the workspace path segment, [your own ID](/docs/guides/use-your-own-ids) works:
```bash theme={null}
curl "https://api.cadenya.com/v1/workspaces/external_id:development/agents" \
-H "Authorization: Bearer ${CADENYA_API_KEY}"
```
Set `metadata.externalId` on a workspace once and a full URL never mentions a Cadenya ID:
```
/v1/workspaces/external_id:production/agents/external_id:support-bot
```
## Name the workspace, do not infer it
Pick a workspace deliberately. A setup script that discovers one and creates an agent in it is a script that eventually creates an agent in production.
```typescript theme={null}
// Deliberate. Reads the same in every environment.
const workspaceId = 'external_id:production';
await client.agents.create({
workspaceId,
metadata: { name: 'Support', externalId: 'support' },
spec: { variationSelectionMode: 'VARIATION_SELECTION_MODE_WEIGHTED' },
});
```
Pair this endpoint with `/v1/whoami` when a tool needs to show a human which workspaces they can act on, and let them choose.
## Which identity is asking
```typescript theme={null}
const profile = await client.profiles.whoami();
console.log(profile.spec.type); // 'PROFILE_TYPE_API_KEY'
console.log(profile.spec.name); // 'Global API Key'
```
A profile is a person or a machine inside an account, and it moves between workspaces without a fresh invite. `whoami` names the one behind the current token.
## Related
`external_id:` resolves in the workspace segment too.
Why the account holds keys and the workspace holds everything else.
Which identity the token carries.
The first thing you build inside a workspace.
## OpenAPI
````yaml get /v1/workspaces
openapi: 3.1.0
info:
title: Cadenya API
description: API for the Cadenya Agent Runtime platform.
version: '1.0'
servers:
- url: https://api.cadenya.com
description: Production server
security:
- bearerAuth: []
tags:
- name: AIProviderKeyService
- name: APIKeyService
description: |-
Issue, rotate, disable, and revoke a workspace's API keys. Every key
belongs to exactly one workspace; the system-managed global account key is
managed via GlobalAPIKeyService instead.
- name: AccountService
description: >-
Manage the authenticated account. Accounts are the top-level
organizational
unit and contain one or more workspaces.
- name: AgentScheduleService
description: >-
Manage recurring schedules attached to agents. Schedules trigger
objectives
on a cadence defined by AgentScheduleSpec.Schedule.
- name: AgentService
description: >-
Manage AI agents within a workspace. Agents define AI behavior and tool
access.
- name: AgentVariationService
description: >-
Manage variations of an agent and their tool, sub-agent, and memory layer
assignments.
- name: GlobalAPIKeyService
description: |-
Manage the account's system-provisioned global API key. The global key is
the only key that spans every workspace; it is created by the system and
cannot be deleted, so the surface is retrieve, rotate, and the
disable/enable kill switch.
- name: MemoryService
description: >-
Manage memory layers and their entries. Layers are named containers that
can
be composed into an objective's memory cascade; entries are the keyed values
within a layer. System-managed layers (e.g., episodic layers created by the
runtime) cannot be mutated through this API.
- name: ModelService
description: |-
Manage LLM models available to a workspace. Models represent provider and
family pairs (e.g., "anthropic/claude-sonnet-4.6"). Workspaces are seeded
with the supported models and you can enable or disable each one.
- name: ObjectiveEventStreamsService
- name: ObjectiveService
- name: ProfilesService
description: |-
Operations on profiles, the account-level principals (users, API keys,
system) that authenticate against the API.
- name: SearchService
- name: TenantService
description: >-
Read and erase tenants and the subjects under them. Tenants and subjects
are
created by assertion — on objective creation or widget session mint — never
directly, so this service has no create or update: it exists to enumerate what
assertions have produced, and to destroy it on request.
- name: ToolService
description: >-
Manage tool sets and the tools they contain. Tool sets group related
tools,
and tools define specific capabilities available to agents.
When a tool set is managed, only API key actors can modify its tools; human
(profile) actors cannot.
- name: UploadService
description: |-
Issue short-lived presigned URLs for direct client-to-object-storage
uploads. Created uploads can be referenced by id when creating or updating
resources that accept binary content (e.g., MemoryEntry).
- name: WidgetService
description: |-
Manage embeddable chat widgets. A widget binds an agent to a globally
unique hostname with a per-widget origin allowlist; browsers reach it with
session tokens minted via WidgetSessionService.
- name: WidgetSessionService
description: >-
Mint and manage widget sessions. Session creation is server-to-server
only:
the customer's backend authenticates its visitor, asserts tenant/subject
context, attaches any per-visitor secrets, and receives a short-lived
bearer token the browser uses against the widget host.
- name: WorkspaceAdminService
description: >-
Administer workspaces across the account: create and archive workspaces
and
manage their membership. These operations are account-scoped and require the
admin role (a token whose profile holds the WorkOS admin role); they live
under /v1/account/workspaces rather than the workspace-scoped /v1/workspaces
tree so an admin can manage any workspace in the account, including ones they
are not themselves a member of.
- name: WorkspaceSecretService
- name: WorkspaceService
description: |-
Manage workspaces within an account. Workspaces provide organizational
grouping and isolation for resources such as agents, tools, and API keys.
This is the workspace-scoped, end-user surface. Administrative operations
(create / archive workspaces, manage members) live in WorkspaceAdminService
under /v1/account/workspaces and require the admin role.
paths:
/v1/workspaces:
get:
tags:
- WorkspaceService
- Workspaces
summary: List workspaces
description: Lists all workspaces for the current account
operationId: WorkspaceService_ListWorkspaces
parameters:
- name: limit
in: query
description: Maximum number of results to return
schema:
type: integer
format: int32
- name: cursor
in: query
description: Pagination cursor from previous response
schema:
type: string
- name: sortOrder
in: query
description: Sort order for results (asc or desc by creation time)
schema:
type: string
- name: includeInfo
in: query
description: When set to true you may use more of your alloted API rate-limit
schema:
type: boolean
- name: labels
in: query
description: |-
Filters by metadata labels. Comma-separated key=value pairs,
e.g. "env=prod,team=ai". A resource matches only if every pair
matches exactly (AND semantics).
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ListWorkspacesResponse'
default:
description: Default error response
content:
application/json:
schema:
$ref: '#/components/schemas/Status'
x-codeSamples:
- lang: JavaScript
source: |-
import Cadenya from '@cadenya/cadenya';
const client = new Cadenya({
apiKey: process.env['CADENYA_API_KEY'], // This is the default and can be omitted
});
// Automatically fetches more pages as needed.
for await (const workspace of client.workspaces.list()) {
console.log(workspace.metadata);
}
- lang: Python
source: |-
import os
from cadenya import Cadenya
client = Cadenya(
api_key=os.environ.get("CADENYA_API_KEY"), # This is the default and can be omitted
)
page = client.workspaces.list()
page = page.items[0]
print(page.metadata)
- lang: Go
source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"go.cadenya.com/cadenya-go\"\n\t\"go.cadenya.com/cadenya-go/option\"\n)\n\nfunc main() {\n\tclient := cadenya.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tpage, err := client.Workspaces.List(context.TODO(), cadenya.WorkspaceListParams{})\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", page)\n}\n"
- lang: Ruby
source: |-
require "cadenya"
cadenya = Cadenya::Client.new(api_key: "My API Key")
page = cadenya.workspaces.list
puts(page)
- lang: CLI
source: |-
cadenya workspaces list \
--api-key 'My API Key'
components:
schemas:
ListWorkspacesResponse:
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/Workspace'
pagination:
$ref: '#/components/schemas/Page'
Status:
type: object
properties:
code:
type: integer
description: >-
The status code, which should be an enum value of
[google.rpc.Code][google.rpc.Code].
format: int32
message:
type: string
description: >-
A developer-facing error message, which should be in English. Any
user-facing error message should be localized and sent in the
[google.rpc.Status.details][google.rpc.Status.details] field, or
localized by the client.
details:
type: array
items:
$ref: '#/components/schemas/GoogleProtobufAny'
description: >-
A list of messages that carry the error details. There is a common
set of message types for APIs to use.
description: >-
The `Status` type defines a logical error model that is suitable for
different programming environments, including REST APIs and RPC APIs. It
is used by [gRPC](https://github.com/grpc). Each `Status` message
contains three pieces of data: error code, error message, and error
details. You can find out more about this error model and how to work
with it in the [API Design
Guide](https://cloud.google.com/apis/design/errors).
Workspace:
required:
- metadata
- spec
type: object
properties:
metadata:
$ref: '#/components/schemas/AccountResourceMetadata'
spec:
$ref: '#/components/schemas/WorkspaceSpec'
status:
readOnly: true
enum:
- STATUS_ENABLED
- STATUS_DISABLED
- STATUS_ARCHIVED
type: string
description: |-
Lifecycle status of the workspace. Archived workspaces reject all
requests scoped to them. Server-populated.
format: enum
info:
readOnly: true
allOf:
- $ref: '#/components/schemas/WorkspaceInfo'
description: The workspace information
Page:
type: object
properties:
nextCursor:
type: string
description: >-
Page carries cursor-based pagination state. There is no total: the
cursor
walks the result set without ever counting it, and a count would cost a second
query on every list.
GoogleProtobufAny:
type: object
properties:
'@type':
type: string
description: The type of the serialized message.
additionalProperties: true
description: >-
Contains an arbitrary serialized message along with a @type that
describes the type of the serialized message.
AccountResourceMetadata:
required:
- id
- accountId
- name
- profileId
type: object
properties:
id:
readOnly: true
type: string
description: >-
Unique identifier for the resource (prefixed ULID, e.g.,
"apikey_01HXK...")
accountId:
readOnly: true
example: account_01HXKD2E5NQM3T9AYWCFTJHJVF
type: string
description: >-
Account this resource belongs to for multi-tenant isolation
(prefixed ULID)
name:
type: string
description: >-
Human-readable name for the resource (e.g., "Customer Support
Agent", "Email Tool")
Required for resources that users interact with directly
externalId:
type: string
description: >-
External ID for the resource (e.g., a workflow ID from an external
system)
labels:
type: object
additionalProperties:
type: string
description: |-
Key-value pairs for categorization and filtering. Values are 0-63
alphanumeric characters with "-", "_", or "." allowed between; keys
follow the same shape and additionally accept an optional DNS-subdomain
prefix (e.g. "cadenya.com/") of at most 253 characters.
Examples: {"environment": "production", "team": "platform", "version": "v2"}
profileId:
readOnly: true
example: profile_01HXKD2E5NQM3T9AYWCFS0AP08
type: string
createdAt:
readOnly: true
type: string
format: date-time
description: >-
AccountResourceMetadata is used to represent a resource that is
associated to an account but not to a workspace.
WorkspaceSpec:
type: object
properties:
description:
type: string
WorkspaceInfo:
type: object
properties:
totalAvailableTools:
type: integer
format: int32
totalMemoryEntries:
type: integer
format: int32
totalAgents:
type: integer
format: int32
totalAgentVariations:
type: integer
format: int32
description: WorkspaceInfo returns counts
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
````