Workspaces

A workspace contains resources, members, and billing. You can belong to multiple workspaces, each with its own role and write grants.

Workspace responses contain id and name strings, an owner object with id and name, and a flags array. They do not include your role. Use the member endpoints to read roles and write grants.

User-scoped endpoints accept your user ID or @me as uid. Ordinary callers can list and create only their own workspaces.

Search workspaces

GET/v1/users/{uid}/workspacesSearch workspaces

Lists the workspaces the user belongs to.

Path parameters

Name	Type	Required	Description
uid	string	yes	User ID, or @me for the current user

Query parameters

Name	Type	Required	Description
q	string	no	Quick search by name or ID
id	string[]	no	List of workspace IDs to filter
name	string	no	Workspace name to filter
owner	string[]	no	List of owner user IDs to filter

Plus the shared pagination query parameters.

Returns 200 OK with a keyset-paged list of workspace objects.

Create a workspace

POST/v1/users/{uid}/workspacesCreate a workspace

Creates a workspace owned by the given user. We grant its owner the owner role and write access to all resource kinds. Ordinary users may own at most three workspaces.

Path parameters

Name	Type	Required	Description
uid	string	yes	User ID, or @me for the current user

Request body

The JSON body is required.

Field	Type	Required	Description
name	string	yes	Workspace name. 4-32 characters.

Returns 200 OK with the workspace object.

{
  "name": "my-workspace"
}

curl -X POST https://api.galaxygate.net/v1/users/@me/workspaces \
  -H "Authorization: Bearer $GALAXYGATE_TOKEN" \
  -H "Content-Type: application/json" \
  -A 'curl/8.5' \
  -d '{ "name": "my-workspace" }'

Fetch a workspace

GET/v1/workspaces/{wid}Fetch a workspace

Requires membership in the workspace.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID

Returns 200 OK with the workspace object.

Update a workspace

PATCH/v1/workspaces/{wid}Update a workspace

Send only the fields you are changing. Renaming and changing SSH password authentication require admin or owner. Changing mfa_required or order_approval_required requires owner. Enabling mfa_required fails unless every member already has two-factor authentication enabled.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID

Request body

The JSON body is required.

Field	Type	Required	Description
disable_ssh_password	boolean	no	Disable SSH password authentication when SSH keys are present
mfa_required	boolean	no	Require all members to have two-factor authentication enabled
name	string	no	Workspace name. 4-32 characters.
order_approval_required	boolean	no	Hold orders from members other than the owner until the owner approves them

Returns 200 OK with the updated workspace object.

{
  "order_approval_required": true
}

Delete a workspace

DELETE/v1/workspaces/{wid}Delete a workspace

Permanently deletes an empty workspace. Requires owner and elevated authentication. Cancel all billed services and delete all resources first.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID

Returns 204 No Content with an empty body.

Fetch quota usage

GET/v1/workspaces/{wid}/quotaFetch quota usage

Returns workspace limits rather than current resource usage.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID

Returns 200 OK with a quota object:

Field	Type	Description
firewall_rules_per_ip	integer	Maximum number of firewall rules per IP address
id	string or null	Quota ID, or null when the workspace uses the default limits
iso_count	integer	Maximum number of ISOs that can be uploaded
iso_storage_bytes	integer	Maximum total ISO size that can be stored (in bytes)
max_bgp_prefixes	integer	Maximum number of BGP prefixes that can be announced
max_cpu_cores	integer	Maximum vCPUs across the workspace's servers
max_instances	integer	Maximum number of servers the workspace can hold
max_memory_bytes	integer	Maximum memory across the workspace's servers (in bytes)
max_ssh_keys	integer	Maximum number of SSH keys that can be uploaded
max_storage_bytes	integer	Maximum disk across the workspace's servers (in bytes)
max_vpcs	integer	Maximum number of VPCs that can be created
owner	object	Workspace this quota applies to

Fetch topology

GET/v1/workspaces/{wid}/topologyFetch topology

Returns instances, floating IPs, VPCs, dediboxes, and network load balancers with their associations.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID

Returns 200 OK with a topology object:

Field	Type	Description
instances	object[]	Instance views with id, name, online, sku, and state
ips	object[]	Floating IPs with id, instance_id, address, and protected
vpcs	object[]	VPCs with id, name, range, and nullable vni
dediboxes	object[]	Dedibox views
net_balancers	object[]	Network load balancers with member associations

Invites

An invite sends a single-use code to the specified email address. Pending invites expire after seven days. Accepting an invite creates membership with its role and write grants.

Roles are member, admin, and owner. Invite request schemas enumerate all three, but we reject owner because workspace ownership is unique. You may grant only a role below your own. An admin can invite a member. An owner can invite a member or admin.

Writable kinds are instance, dedibox, app, image, net_balancer, disk, and floating_ip. Use * for all kinds. Omitted, null, or empty write_kinds grants no write access. The same values apply to member grant endpoints.

Invite detail responses contain the following fields. We send the code by email and do not return it in the response.

Field	Type	Description
accepted	string or null	When accepted, if it has been. ISO 8601 timestamp.
email	string or null	Invited email
expires	string or null	Expiry time. ISO 8601 timestamp.
id	string	Invite ID
role	string or null	Granted governance role
workspace_id	string	Workspace ID
workspace_name	string or null	Workspace name
write_kinds	string[]	Kinds the member may write

Search workspace invites

GET/v1/workspaces/{wid}/invitesSearch workspace invites

Lists pending invites. Requires workspace membership.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID

Query parameters

Name	Type	Required	Description
q	string	no	Quick search by email or ID
id	string[]	no	List of invite IDs to filter
email	string	no	Invited email to filter
role	string	no	Granted governance role to filter
workspace	string[]	no	List of workspace IDs to filter

Plus the shared pagination query parameters.

Returns 200 OK with a keyset-paged list of invite summaries. Each summary has id, email, workspace with id and name, role, write_kinds, expires, and accepted.

Search user invites

GET/v1/users/{uid}/invitesSearch user invites

Lists pending invitations addressed to the user. Ordinary callers can list only their own invites.

Path parameters

Name	Type	Required	Description
uid	string	yes	User ID, or @me for the current user

Query parameters

Name	Type	Required	Description
q	string	no	Quick search by email or ID
id	string[]	no	List of invite IDs to filter
email	string	no	Invited email to filter
role	string	no	Granted governance role to filter
workspace	string[]	no	List of workspace IDs to filter

Plus the shared pagination query parameters.

Returns 200 OK with the same keyset-paged invite summaries as workspace invite search.

Create an invite

POST/v1/workspaces/{wid}/invitesCreate an invite

Sends the single-use code to email. The granted role must be below your own. We reject owner.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID

Request body

The JSON body is required.

Field	Type	Required	Description
email	string	yes	Email address to invite
role	string	yes	Governance role. Values: member, admin, owner.
write_kinds	string[] or null	no	Resource kinds the member may write, ['*'] for all, empty or null for read-only

Returns 201 Created with the invite detail object.

{
  "email": "[email protected]",
  "role": "member",
  "write_kinds": [
    "instance",
    "disk"
  ]
}

Look up a pending invite by code

GET/v1/invites/lookupLook up a pending invite by code

Does not require authentication. Returns 404 Not Found once the invite has been accepted or expired.

Query parameters

Name	Type	Required	Description
code	string	yes	Invite code from the invitation email

Returns 200 OK with the invite detail object.

Accept an invite

POST/v1/invitesAccept an invite

Adds the authenticated user to the workspace. Rejects expired or accepted codes, an email mismatch, and existing membership. A workspace requiring two-factor authentication rejects users who have not enabled it.

Request body

The JSON body is required.

Field	Type	Required	Description
code	string	yes	Invite code

Returns 200 OK with the accepted invite detail object.

{
  "code": "invite-code-from-email"
}

Fetch an invite

GET/v1/invites/{iid}Fetch an invite

Requires membership in the invite's workspace.

Path parameters

Name	Type	Required	Description
iid	string	yes	Invite ID

Returns 200 OK with the invite detail object.

Update an invite

PATCH/v1/invites/{iid}Update an invite

Updates a pending invite's role and replaces its write grants. We reject accepted invites and owner. The granted role must be below your own. Omitting write_kinds clears its write grants.

Path parameters

Name	Type	Required	Description
iid	string	yes	Invite ID

Request body

The JSON body is required.

Field	Type	Required	Description
role	string	yes	Governance role. Values: member, admin, owner.
write_kinds	string[] or null	no	Resource kinds the member may write, ['*'] for all, empty or null for read-only

Returns 200 OK with the updated invite detail object.

{
  "role": "member",
  "write_kinds": [
    "instance"
  ]
}

Delete an invite

DELETE/v1/invites/{iid}Delete an invite

Deletes the invitation record. Requires admin or owner. Deleting an accepted invitation does not remove membership. Use the member endpoint to revoke access.

Path parameters

Name	Type	Required	Description
iid	string	yes	Invite ID

Returns 202 Accepted with an empty body.

Members

Membership is separate from invitation records. Reading members requires membership in the workspace. Changing a member or their grants requires a role strictly above that member. You cannot manage yourself or a peer. Changing a role also requires a role above the new role.

List members

GET/v1/workspaces/{wid}/membersList members

Lists workspace members with their role and write grants.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID

Query parameters

Name	Type	Required	Description
q	string	no	Quick search by ID, name or email
id	string[]	no	List of user IDs to filter
name	string	no	User name to filter, matching any part of the name
email	string	no	User email to filter, matching any part of the address

Plus the shared pagination query parameters.

Returns 200 OK with a keyset-paged list. Each item has id, name, email, role, and write_kinds.

Fetch a member

GET/v1/workspaces/{wid}/members/{uid}Fetch a member

Accepts @me for the current member. Returns 404 Not Found if the user is not a member.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID
uid	string	yes	User ID, or @me for the current user

Returns 200 OK with a member object:

Field	Type	Description
email	string	User email
name	string	User name
role	string	Governance role
user_id	string	User ID
write_kinds	string[]	Kinds the member may write

Change a member role

PUT/v1/workspaces/{wid}/members/{uid}Change a member role

Changes an existing member's role. Membership must already exist. Ownership cannot be granted through this endpoint.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID
uid	string	yes	User ID of the member to manage

Request body

The JSON body is required.

Field	Type	Required	Description
role	string	yes	Governance role. Values: member, admin.

Returns 204 No Content with an empty body.

{
  "role": "member"
}

Remove a member

DELETE/v1/workspaces/{wid}/members/{uid}Remove a member

Removes membership and all write grants.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID
uid	string	yes	User ID of the member to manage

Returns 204 No Content with an empty body.

Set write grants

PUT/v1/workspaces/{wid}/members/{uid}/grantsSet write grants

Replaces all writable kinds for an existing member. An omitted, null, or empty write_kinds clears every write grant.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID
uid	string	yes	User ID of the member to manage

Request body

The JSON body is required.

Field	Type	Required	Description
write_kinds	string[] or null	no	The kinds the member may write, replaces the member's current set. An empty list or null clears every write grant

Returns 204 No Content with an empty body.

{
  "write_kinds": [
    "instance",
    "disk"
  ]
}

Grant write on a kind

PUT/v1/workspaces/{wid}/members/{uid}/grants/{kind}Grant write on a kind

Grants write access to a resource kind for an existing member.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID
uid	string	yes	User ID of the member to manage
kind	string	yes	. Values: instance, dedibox, app, image, net_balancer, disk, floating_ip, *.

Returns 204 No Content with an empty body.

Revoke write on a kind

DELETE/v1/workspaces/{wid}/members/{uid}/grants/{kind}Revoke write on a kind

Removes the write grant for the specified kind.

Path parameters

Name	Type	Required	Description
wid	string	yes	Workspace ID
uid	string	yes	User ID of the member to manage
kind	string	yes	. Values: instance, dedibox, app, image, net_balancer, disk, floating_ip, *.

Returns 204 No Content with an empty body.