Cast AI Workspaces API

Provides the API for managing workspaces. A workspace is a sandbox-manager-owned record that maps to one or more remote sessions multiplexed by the sandbox.

Operations 11

POST /ai-optimizer/v1beta/organizations/{organizationId}/workspaces Create a workspace #
GET /ai-optimizer/v1beta/organizations/{organizationId}/workspaces List workspaces #
DELETE /ai-optimizer/v1beta/organizations/{organizationId}/workspaces/{id} Delete workspace #
GET /ai-optimizer/v1beta/organizations/{organizationId}/workspaces/{id} Get workspace by ID #
PUT /ai-optimizer/v1beta/organizations/{organizationId}/workspaces/{id} Create or update a workspace #
GET /ai-optimizer/v1beta/organizations/{organizationId}/workspaces/{id}:cost Get a single workspace's cost #
POST /ai-optimizer/v1beta/organizations/{organizationId}/workspaces/{id}:resume Resume workspace #
POST /ai-optimizer/v1beta/organizations/{organizationId}/workspaces/{id}:suspend Suspend workspace #
GET /ai-optimizer/v1beta/organizations/{organizationId}/workspaces:costPrices Get the effective workspace cost unit prices #
GET /ai-optimizer/v1beta/organizations/{organizationId}/workspaces:costReport Get the workspace cost report over a period #
GET /ai-optimizer/v1beta/organizations/{organizationId}/workspaces:getSecretMappings Get the caller's effective workspace secret mappings #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API
curl "https://apis.io/api/v1/apis/kimchi:kimchi-workspacesapi-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

kimchi-workspacesapi-api-openapi.yml Raw ↑
openapi: 3.2.0
info:
  title: AI Enabler Workspaces API
  version: 0.0.1
  description: 'Provides the API for managing workspaces. A workspace is a sandbox-manager-owned

    record that maps to one or more remote sessions multiplexed by the sandbox.'
servers:
- url: https://api.cast.ai/
  description: US endpoint
- url: https://api.eu.cast.ai/
  description: EU endpoint
security:
- BearerAuth: []
- ApiKeyAuth: []
tags:
- name: WorkspacesAPI
  description: 'Provides the API for managing workspaces. A workspace is a sandbox-manager-owned

    record that maps to one or more remote sessions multiplexed by the sandbox.'
paths:
  /ai-optimizer/v1beta/organizations/{organizationId}/workspaces:
    post:
      tags:
      - WorkspacesAPI
      summary: Create a workspace
      description: Creates a workspace.
      operationId: WorkspacesAPI_CreateWorkspace
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Workspace'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace'
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
    get:
      tags:
      - WorkspacesAPI
      summary: List workspaces
      description: Lists workspaces for the organization.
      operationId: WorkspacesAPI_ListWorkspaces
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      - name: creatorId
        in: query
        description: Filter by creator ID.
        schema:
          type: string
      - name: page.limit
        in: query
        description: Defines the number of items that should be returned
        schema:
          type: string
      - name: page.cursor
        in: query
        description: "Cursor that defines token indicating where to start the next page.\n Empty value indicates to start from beginning of the dataset."
        schema:
          type: string
      - name: sort.field
        in: query
        description: The field name to order by. Nested fields can be specified by using a dot (e.g. user.name).
        schema:
          type: string
      - name: sort.order
        in: query
        description: The order of returned items. Default is ASC.
        schema:
          enum:
          - ASC
          - asc
          - DESC
          - desc
          type: string
          format: enum
      - name: clientType
        in: query
        description: Filter by client type.
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListWorkspacesResponse'
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
  /ai-optimizer/v1beta/organizations/{organizationId}/workspaces/{id}:
    delete:
      tags:
      - WorkspacesAPI
      summary: Delete workspace
      description: Deletes a workspace.
      operationId: WorkspacesAPI_DeleteWorkspace
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      - name: id
        in: path
        description: The ID of the workspace.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content: {}
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
    get:
      tags:
      - WorkspacesAPI
      summary: Get workspace by ID
      description: Gets a workspace by ID.
      operationId: WorkspacesAPI_GetWorkspace
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      - name: id
        in: path
        description: The ID of the workspace.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace'
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
    put:
      tags:
      - WorkspacesAPI
      summary: Create or update a workspace
      description: Creates or updates a workspace.
      operationId: WorkspacesAPI_UpsertWorkspace
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      - name: id
        in: path
        description: The ID of the workspace.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Workspace'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace'
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
  /ai-optimizer/v1beta/organizations/{organizationId}/workspaces/{id}:cost:
    get:
      tags:
      - WorkspacesAPI
      summary: Get a single workspace's cost
      description: 'Gets the fixed-rate cost of a single workspace, optionally over a

        period. A missing window bound defaults to the workspace''s lifetime

        bound on that side (create time, or deletion time / now). A two-sided

        window entirely outside the lifetime yields zero costs, while a

        one-sided window that does not intersect the lifetime is rejected as

        invalid. Works for deleted workspaces too.'
      operationId: WorkspacesAPI_GetWorkspaceCost
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      - name: id
        in: path
        description: The ID of the workspace.
        required: true
        schema:
          type: string
      - name: startTime
        in: query
        description: "Start of the cost window (inclusive). Optional: defaults to the\n workspace's create time. When end_time is not given, a start that lies\n beyond the workspace's lifetime end is rejected as invalid."
        schema:
          type: string
          format: date-time
      - name: endTime
        in: query
        description: "End of the cost window (exclusive). Optional: defaults to the\n workspace's deletion time, or now when it is not deleted. When\n start_time is not given, an end that lies before the workspace's\n create time is rejected as invalid."
        schema:
          type: string
          format: date-time
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspaceCost'
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
  /ai-optimizer/v1beta/organizations/{organizationId}/workspaces/{id}:resume:
    post:
      tags:
      - WorkspacesAPI
      summary: Resume workspace
      description: Resumes a workspace.
      operationId: WorkspacesAPI_ResumeWorkspace
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      - name: id
        in: path
        description: The ID of the workspace.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResumeWorkspaceRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResumeWorkspaceResponse'
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
  /ai-optimizer/v1beta/organizations/{organizationId}/workspaces/{id}:suspend:
    post:
      tags:
      - WorkspacesAPI
      summary: Suspend workspace
      description: Suspends a workspace.
      operationId: WorkspacesAPI_SuspendWorkspace
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      - name: id
        in: path
        description: The ID of the workspace.
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SuspendWorkspaceRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuspendWorkspaceResponse'
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
  /ai-optimizer/v1beta/organizations/{organizationId}/workspaces:costPrices:
    get:
      tags:
      - WorkspacesAPI
      summary: Get the effective workspace cost unit prices
      description: 'Gets the effective fixed-rate workspace cost unit prices for the

        organization: its override row when present, else the global default.

        These are the rates GetWorkspaceCostReport and GetWorkspaceCost apply to

        resource requests and lifetime overlap.'
      operationId: WorkspacesAPI_GetWorkspaceCostPrices
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspaceCostPrices'
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
  /ai-optimizer/v1beta/organizations/{organizationId}/workspaces:costReport:
    get:
      tags:
      - WorkspacesAPI
      summary: Get the workspace cost report over a period
      description: 'Lists the fixed-rate costs of the workspaces visible to the caller over

        a period — the same per-user visibility the workspace list applies

        (members see their own and org-wide-shared workspaces, organization

        owners see the whole org). Costs are computed from unit prices,

        workspace resource requests and the overlap of each workspace''s lifetime

        with the requested period; workspaces deleted during the period are

        included.'
      operationId: WorkspacesAPI_GetWorkspaceCostReport
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      - name: startTime
        in: query
        description: Start of the cost period (inclusive). Required; must be before end_time.
        schema:
          type: string
          format: date-time
      - name: endTime
        in: query
        description: End of the cost period (exclusive). Required.
        schema:
          type: string
          format: date-time
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspaceCostReport'
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
  /ai-optimizer/v1beta/organizations/{organizationId}/workspaces:getSecretMappings:
    get:
      tags:
      - WorkspacesAPI
      summary: Get the caller's effective workspace secret mappings
      description: 'Gets the caller''s effective secret injection mappings: the environment

        variable name -> KAP secret reference (secret_id UUID) map that

        CreateWorkspace injects for the caller when spec.secret_mappings is

        unset (the fallback resolved from the caller''s effective secrets).

        Metadata only: secret values are never exposed by this API.'
      operationId: WorkspacesAPI_GetSecretMappings
      parameters:
      - name: organizationId
        in: path
        description: The ID of the organization.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretMappings'
        default:
          description: Default error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Status'
components:
  schemas:
    ListWorkspacesResponse:
      required:
      - items
      - totalCount
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Workspace'
          description: The list of workspaces.
        nextPageCursor:
          type: string
          description: The pagination cursor to retrieve the next page.
        totalCount:
          type: integer
          description: The total number of items.
          format: int32
      description: Response message for listing workspaces.
    SecretReferences_NoSecrets:
      type: object
      properties: {}
      description: "NoSecrets explicitly marks a workspace created with no secret\n injection at all."
    SecretMappings:
      type: object
      properties:
        mappings:
          type: object
          additionalProperties:
            type: string
          description: "Environment variable name -> KAP secret reference (secret_id UUID), in\n the same shape as WorkspaceSpec.secret_mappings. Empty when the user\n has no effective secrets."
      description: "SecretMappings is the caller's effective secret injection mapping set:\n the response of GetSecretMappings."
    GoogleProtobufAny:
      type: object
      properties:
        '@type':
          type: string
          description: The type of the serialized message.
      additionalProperties: true
      description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.
    Workspace:
      type: object
      properties:
        id:
          readOnly: true
          type: string
          description: The ID of the workspace.
        organizationId:
          readOnly: true
          type: string
          description: The ID of the organization.
        creatorId:
          readOnly: true
          type: string
          description: The ID of the user who created the workspace.
        description:
          type: string
          description: The description of the workspace.
        status:
          readOnly: true
          enum:
          - STATUS_UNSPECIFIED
          - INITIALIZING
          - ACTIVE
          - SUSPENDED
          - DELETING
          - UNKNOWN
          - TERMINATED
          - FAILED
          type: string
          description: Status of the workspace.
          format: enum
        createTime:
          readOnly: true
          type: string
          description: The time when the workspace was created.
          format: date-time
        uri:
          readOnly: true
          type: string
          description: URI for accessing the workspace via websocket.
        options:
          writeOnly: true
          allOf:
          - $ref: '#/components/schemas/WorkspaceOptions'
          description: Workspace creation options. Only used during upsert; never returned.
        hostIdentityPublicKey:
          readOnly: true
          type: string
          description: The host identity public key for SSH access.
        clientType:
          type: string
          description: The client type that created the workspace, e.g. "harness".
        cluster:
          readOnly: true
          type: string
          description: The name of the cluster this workspace is hosted on.
        spec:
          allOf:
          - $ref: '#/components/schemas/WorkspaceSpec'
          description: "Create-time parameters of the workspace. On input (create/upsert),\n carries requested parameters. On output, only spec.resources is\n populated, with the resolved (provisioned) values; dependencies and\n egress policy are never returned."
        templateName:
          type: string
          description: "The name of the workspace template to base the workspace on: resolved\n at creation time to whatever template currently carries that name\n (convenience reference; set template_id instead to pin an exact\n template). Applied only when creating a new workspace: the template is\n resolved to a snapshot of its values at creation time, so later\n template edits affect only newly created workspaces. On create,\n conflicts with spec: set either template fields or explicit parameters,\n never both. When upserting an existing workspace, spec may accompany an\n echo-equal template reference: a read-modify-write round trip carries\n both, and divergent values are rejected. Set at most\n one of template_name/template_id on input; when both are set they must\n refer to the same template. Immutable after creation: when upserting\n an existing workspace, must be absent or equal to the stored value.\n After creation, always populated together with template_id as a\n historical record; template edits or deletion do not affect the\n workspace."
        templateId:
          type: string
          description: "The ID of the workspace template to base the workspace on, pinning an\n exact template incarnation (strict reference; set template_name\n instead to resolve whatever currently carries that name). Applied only\n when creating a new workspace, with the same conflict, both-set\n agreement and immutability rules as template_name. After creation,\n always populated together with template_name as a historical record;\n template edits or deletion do not affect the workspace."
        secretReferences:
          readOnly: true
          allOf:
          - $ref: '#/components/schemas/SecretReferences'
          description: "Secret references of the workspace, as an explicit either/or state:\n no_secrets marks a workspace created without secret injection;\n secrets carries the environment variable name -> KAP secret\n reference (the secret_id UUID) map whose values the sandbox sidekick\n injects at runtime. Snapshot of the create-time spec.secret_mappings\n (explicit or resolved from the creator's effective secrets); never\n exposes secret values."
      description: Workspace represents a sandbox workspace.
    SecretReferences_Secrets:
      type: object
      properties:
        mappings:
          type: object
          additionalProperties:
            type: string
          description: Environment variable name -> KAP secret reference (secret_id UUID).
      description: "Secrets maps environment variable names to KAP secret references\n (the secret_id UUID) whose values the sandbox sidekick injects into\n those environment variables at runtime."
    SuspendWorkspaceResponse:
      type: object
      properties: {}
      description: Response message for suspending a workspace.
    WorkspaceCostPrices:
      required:
      - cpuHourly
      - memoryHourly
      - pvcHourly
      - ephemeralHourly
      type: object
      properties:
        cpuHourly:
          type: string
          description: Price per vCPU-hour, in USD.
        memoryHourly:
          type: string
          description: Price per GiB-hour of memory, in USD.
        pvcHourly:
          type: string
          description: Price per GiB-hour of PVC storage, in USD.
        ephemeralHourly:
          type: string
          description: Price per GiB-hour of ephemeral storage, in USD.
      description: "The effective fixed-rate unit prices applied to workspace costs: the\n organization's override row when present, else the global default."
    EgressPolicy:
      type: object
      properties:
        denyByDefault:
          type: boolean
          description: "When true (the default), only `allowed` destinations pass. Explicitly\n set to false to request the default-allow posture (everything passes\n except `denied`)."
        allowed:
          type: array
          items:
            type: string
          description: "Egress destinations to allow: lowercase domains (optionally a leading\n `*.` wildcard), IPv4/IPv6 CIDRs; each optionally suffixed with `:<port>`."
        denied:
          type: array
          items:
            type: string
          description: Egress destinations to deny; same grammar as `allowed`, wins over it.
      description: "EgressPolicy describes the outbound network policy enforced by the in-pod\n sidekick proxy: when deny_by_default is true, only `allowed` destinations\n pass; `denied` always takes precedence over `allowed`.\n\n The operator is the authoritative validator of the entry grammar\n (kimchi-operator internal/domain/validate.go, ValidateEgressPolicy); the\n bounds below only cap request size at the API edge. Grammar violations\n travel to the operator, whose HTTP 400 surfaces here as InvalidArgument."
    Status:
      type: object
      properties:
        code:
          type: integer
          description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
          format: int32
        message:
          type: string
          description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
        details:
          type: array
          items:
            $ref: '#/components/schemas/GoogleProtobufAny'
          description: A list of messages that carry the error details.  There is a common set of message types for APIs to use.
      description: 'The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).'
    SuspendWorkspaceRequest:
      required:
      - organizationId
      - id
      type: object
      properties:
        organizationId:
          type: string
          description: The ID of the organization.
        id:
          type: string
          description: The ID of the workspace.
      description: Request message for suspending a workspace.
    WorkspaceCostReport:
      required:
      - items
      - totalCost
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/WorkspaceCost'
          description: "One entry per workspace visible to the caller whose lifetime overlaps\n the period, including deleted workspaces. Empty when no visible\n workspace overlaps."
        totalCost:
          type: string
          description: The sum of all item totals over the period.
      description: "The fixed-rate workspace cost report over a period: one entry per\n workspace visible to the caller whose lifetime overlaps the period,\n including deleted ones, plus the total across them."
    WorkspaceResources:
      type: object
      properties:
        cpu:
          type: string
          description: CPU request, e.g. "500m".
        memory:
          type: string
          description: Memory request, e.g. "1Gi".
        pvcSize:
          type: string
          description: Workspace PVC size, e.g. "20Gi".
      description: "WorkspaceResources carries workspace resource requests as Kubernetes\n quantity strings (e.g. \"500m\", \"1Gi\"). Values must be positive."
    WorkspaceOptions:
      type: object
      properties:
        agentApiKey:
          type: string
          description: API token for the agent running in the workspace.
      description: Configuration options passed to the workspace agent on creation.
    WorkspaceCost:
      required:
      - workspaceId
      - creatorId
      - cpuCost
      - memoryCost
      - storageCost
      - totalCost
      - dataSource
      type: object
      properties:
        workspaceId:
          type: string
          description: The ID of the workspace.
        creatorId:
          type: string
          description: The ID of the user the cost is attributed to (the workspace creator).
        cpuCost:
          type: string
          description: CPU cost over the period.
        memoryCost:
          type: string
          description: Memory cost over the period.
        storageCost:
          type: string
          description: 'Storage cost over the period: PVC plus ephemeral storage.'
        totalCost:
          type: string
          description: "Total cost over the period: exactly cpu_cost + memory_cost +\n storage_cost (each component rounded to 6 decimal places first)."
        dataSource:
          enum:
          - WORKSPACE_COST_DATA_SOURCE_UNSPECIFIED
          - WORKSPACE_COST_DATA_SOURCE_FIXED_RATES
          type: string
          description: Where the numbers come from.
          format: enum
      description: The fixed-rate cost of one workspace over a period, in USD.
    ResumeWorkspaceRequest:
      required:
      - organizationId
      - id
      type: object
      properties:
        organizationId:
          type: string
          description: The ID of the organization.
        id:
          type: string
          description: The ID of the workspace.
      description: Request message for resuming a workspace.
    SecretReferences:
      type: object
      properties:
        noSecrets:
          allOf:
          - $ref: '#/components/schemas/SecretReferences_NoSecrets'
          description: Marks a workspace created without secret injection.
        secrets:
          allOf:
          - $ref: '#/components/schemas/SecretReferences_Secrets'
          description: The environment variable -> secret reference mappings.
      description: "SecretReferences is the explicit secret injection state of a workspace:\n either no secrets at all, or the env-var -> secret reference map."
    ResumeWorkspaceResponse:
      type: object
      properties: {}
      description: Response message for resuming a workspace.
    WorkspaceSpec:
      type: object
      properties:
        resources:
          allOf:
          - $ref: '#/components/schemas/WorkspaceResources'
          description: "Resource requests. On input, each set field overrides the\n organization's workspace sizing for that dimension; unset fields\n inherit the organization policy. Immutable after creation: upserting an\n existing workspace with different values is rejected. On output, the\n resolved (provisioned) requests."
        dependencies:
          writeOnly: true
          type: array
          items:
            type: string
          description: "CLI tools to install globally in the sandbox at boot. Entries follow the\n devkit grammar: [registry:]tool[@version], e.g. \"jq\", \"node@22\",\n \"npm:typescript-language-server@0.12.0\". Applied only when creating a\n new workspace: forwarded to the operator at create time; ignored when\n upserting an existing workspace; never returned."
        egressPolicy:
          writeOnly: true
          allOf:
          - $ref: '#/components/schemas/EgressPolicy'
          description: "Outbound network policy of the workspace, enforced by the in-pod\n sidekick proxy. Applied only when creating a new workspace: forwarded to\n the operator at create time; ignored when upserting an existing\n workspace; never returned."
        initScript:
          writeOnly: true
          type: string
          description: "Opaque shell script executed at sandbox boot after dependency\n installation. Applied only when creating a new workspace: forwarded to\n the operator at create time; ignored when upserting an existing\n workspace; never returned. The operator enforces 64KiB UTF-8 bytes; the\n cap below counts characters. Never embed credentials: the script is\n stored verbatim; use secrets instead."
        files:
          writeOnly: true
          type: object
          additionalProperties:
            type: string
          description: "Custom files written into the sandbox filesystem at boot, mapped by\n path to content. Paths are home-relative (under the sandbox home, on\n the workspace volume) and must be clean; absolute paths, ~ and .. are\n not supported. Written before dependency installation, with parent\n directories created on demand. Applied only when creating a new\n workspace: forwarded to the operator at create time; ignored when\n upserting an existing workspace; never returned. The operator is the\n authoritative validator of the path grammar and content rules; grammar\n violations travel to the operator, whose HTTP 400 surfaces here as\n InvalidArgument. It enforces byte caps (64KiB per file, 112KiB\n JSON-encoded across the map); the caps below count characters. Contents\n are plaintext in control-plane objects — configuration, not secrets."
        secretMappings:
          writeOnly: true
          type: object
          additionalProperties:
            type: string
          description: "Secret injection entries mapped by environment variable name to a KAP\n secret reference (the secret_id UUID returned by the internal KAP\n secrets API). The map is JSON-encoded and set on the first container as\n the SIDEKICK_SECRET_INJECTION_CONFIG environment variable, which the\n sidekick consumes to resolve and inject secret values at runtime.\n Environment variable names must match ^[A-Z_][A-Z0-9_]*$; setting\n SIDEKICK_SECRET_INJECTION_CONFIG directly via env or secrets is\n rejected by the operator. Applied only when creating a new workspace:\n forwarded to the operator at create time; never returned (see\n Workspace.secret_references for the echoed state). Note: an explicitly\n empty map is indistinguishable from an unset field (proto3 map getters\n return nil either way) and also triggers the effective-secrets\n fallback below; there is currently no way to opt out of secret\n injection via the spec."
      description: WorkspaceSpec groups the create-time parameters of a workspace.
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
x-provenance:
  method: searched
  source: https://docs.cast.ai/reference
  harvested: '2026-10-20'
  tool: harvest-readme-openapi.py
  note: Assembled verbatim from the OpenAPI definition ReadMe embeds in each operation page of the provider's developer portal; paths and components merged by API title, nothing authored.
  assembled_from:
  - https://docs.cast.ai/reference/analyticsapi_generateanalytics.md


# --- truncated at 32 KB (43 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kimchi/refs/heads/main/openapi/kimchi-workspacesapi-api-openapi.yml