The workspace's saved engine rules
The rules every agent of the workspace runs under: settings.permissions (allow, ask, deny: tool rules in the engine's spelling) and settings.auto_mode (allow, soft_deny, hard_deny, environment: sentences the auto-mode classifier reads). A list that is absent holds nothing. settings_revision is null while nothing is saved. writes_open says whether a save is accepted now; reading is always open. Any member of the workspace reads it, with a console session or with that member's personal API key; an agent's key and the operator key read nothing here.
Scope: sessions:read (API key or cookie session).
AuthorizationBearer <token>For servers and scripts: an API key sent as an HTTP bearer token, Bearer <key>. It holds exactly the scopes it was issued with; a key issued before scopes existed holds none. It never needs the CSRF header, and it cannot manage agents, members, teams or API keys. Issue one in the web console under Settings → API keys; each operation names the scope it needs.
Scope: sessions:read
id*stringThe workspace's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidThe rules and the revision that guards them.
application/json- response
settings*settings_revision*|nullwrites_open*booleancurl -X GET 'https://example.com/v1/workspaces/497f6eca-6276-4993-bfeb-53cbbbba6f08/engine-settings'{ "settings": { "permissions": { "deny": [ "Bash(rm:*)" ] }, "auto_mode": {} }, "settings_revision": 2, "writes_open": true}