One key, one workspace
- An API key is issued for a single workspace. Every request made with it reads and writes that workspace only.
- No endpoint takes a workspace ID. The workspace always comes from the key.
- Requesting another workspace’s resource by ID behaves as if it does not exist (
404). - If you run several workspaces, use a separate key for each.
Workspace status
Acting on behalf of a member
A scoped key acts on behalf of one member of the workspace, by default the owner. Anything the key creates or changes is recorded as done by that member, and the key can do at most what that member is allowed to do right now. If the member is removed or suspended, the key returns403 api_key_owner_inactive until
Pineyard re-assigns it.

