Workspace Auth API

Configure workspace site auth — mode, end users, app roles, SSO, and branding.

These endpoints manage app end-user identity for a workspace. They do not manage platform membership — use the Memberships API for portal roles.

Auth config

Method	Path	Permission
`GET`	`/v1/workspaces/{workspace_id}/auth`	`read`
`PUT`	`/v1/workspaces/{workspace_id}/auth`	`administer`

PUT body (partial): mode (none|groundfloor|external), external, groundfloor, host, branding, mail.

Permission catalog

GET /v1/workspaces/{workspace_id}/auth/permissions

Permission: read

App users

Method	Path	Permission
`GET` / `POST`	`/v1/workspaces/{workspace_id}/users`	`read` / `administer`
`GET` / `PATCH` / `DELETE`	`…/users/{user_id}`	`read` / `administer`
`POST`	`…/users/{user_id}/reset-password`	`administer` (202)

Invite (POST): email, optional role, send_email. List query: first, limit.

App roles

Method	Path	Permission
`GET` / `POST`	`/v1/workspaces/{workspace_id}/auth-roles`	`read` / `administer`
`PATCH`	`…/auth-roles/{role_name}`	`administer`

Create body: name, permissions[], optional description.

SSO brokers

Method	Path	Permission
`GET` / `POST`	`/v1/workspaces/{workspace_id}/auth/sso`	`read` / `administer`
`PATCH` / `DELETE`	`…/auth/sso/{connection_id}`	`administer`
`POST`	`…/auth/sso/{connection_id}/test-login`	`administer`

OIDC/SAML fields plus optional client_secret on create/update.

Activity

Auth-related events appear on the Audit API (GET …/workspaces/{id}/audit). There is no separate auth-audit route.

Public host discovery

Unauthenticated helpers (rate-limited):

Method	Path	Purpose
`GET`	`/v1/public/workspaces/by-host?host=`	OIDC metadata for site host
`GET`	`/v1/public/branding`	Cell branding JSON

Memberships API — platform roles
Shell auth modes