NVIDIA Run:ai Workspaces API

openapi: 3.2.0
info:
  version: latest
  description: '# Introduction


    The NVIDIA Run:ai Control-Plane API reference is a guide that provides an easy-to-use programming interface for adding various tasks to your application, including workload submission, resource management, and administrative operations.


    NVIDIA Run:ai APIs are accessed using *bearer tokens*. To obtain a token, you need to create a **Service account** through the NVIDIA Run:ai user interface.

    To create a service account, in your UI, go to Access → Service Accounts (for organization-level service accounts) or User settings → Access Keys (for user access keys), and create a new one.


    After you have created a new service account, you will need to assign it access rules.

    To assign access rules to the service account, see [Create access rules](https://run-ai-docs.nvidia.com/saas/infrastructure-setup/authentication/accessrules#create-or-delete-rules).

    Make sure you assign the correct rules to your service account. Use the [Roles](https://run-ai-docs.nvidia.com/saas/infrastructure-setup/authentication/roles) to assign the correct access rules.


    To get your access token, follow the instructions in [Request a token](https://run-ai-docs.nvidia.com/saas/reference/api/rest-auth/#request-an-api-token).

    '
  title: NVIDIA Run:ai Access Keys Workspaces API
  x-logo:
    url: https://api.redocly.com/registry/raw/runai-xq8/saas/latest/public/runai-logo-api.png
    altText: NVIDIA Run:ai
    href: https://run.ai
  license:
    name: NVIDIA Run:ai
    url: https://www.nvidia.com/en-us/agreements/enterprise-software/nvidia-software-license-agreement/
servers:
- url: https://app.run.ai
security:
- bearerAuth: []
tags:
- name: Workspaces
  description: "A Workspace is a simplified tool for researchers to conduct experiments, build AI models, access standard MLOps tools, and collaborate with their peers.\nWorkspaces abstract complex concepts related to running containerized workloads in a Kubernetes environment and are built from predefined setups that include\nnetworking, storage, secrets and other resources. All the setup and configurations for research, including container \nimages, data sets, resource requests, as well as all tools are included. for the research, in a single place. \nIt answers the research needs while ensuring infrastructure owners keep control and allocation efficiency.\nA workspace is associated with a specific NVIDIA Run:ai project and you can have multiple workspaces under a specific project. \nFor more information, see [Workspaces](https://run-ai-docs.nvidia.com/saas/workloads-in-nvidia-run-ai/using-workspaces/running-workspace).\n"
paths:
  /api/v1/workloads/workspaces:
    post:
      summary: Create a workspace.
      operationId: create_workspace1
      description: Create a new workspace in a specific project in the cluster.
      tags:
      - Workspaces
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkspaceCreationRequest'
      responses:
        '202':
          description: Request completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace1'
        '400':
          $ref: '#/components/responses/400SubmissionErrorV2'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/workloads/workspaces/{workloadId}:
    delete:
      summary: Delete a workspace.
      description: Delete a workspace using the workspace id.
      operationId: delete_workspace
      tags:
      - Workspaces
      parameters:
      - $ref: '#/components/parameters/WorkloadId'
      responses:
        '202':
          $ref: '#/components/responses/202Accepted'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
    get:
      summary: Get workspace data.
      description: Retrieve workspace details using a workload id.
      operationId: get_workspace
      tags:
      - Workspaces
      parameters:
      - $ref: '#/components/parameters/WorkloadId'
      responses:
        '200':
          description: Executed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace1'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/workloads/workspaces/{workloadId}/suspend:
    post:
      summary: Suspend a workspace.
      description: Suspend a workspace using the workspace id.
      operationId: suspend_workspace
      tags:
      - Workspaces
      parameters:
      - $ref: '#/components/parameters/WorkloadId'
      responses:
        '202':
          $ref: '#/components/responses/202Accepted'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
  /api/v1/workloads/workspaces/{workloadId}/resume:
    post:
      summary: Resume a workspace.
      description: Resume the workspace operation using the workspace id.
      operationId: resume_workspace
      tags:
      - Workspaces
      parameters:
      - $ref: '#/components/parameters/WorkloadId'
      responses:
        '202':
          $ref: '#/components/responses/202Accepted'
        '401':
          $ref: '#/components/responses/401Unauthorized'
        '403':
          $ref: '#/components/responses/403Forbidden'
        '404':
          $ref: '#/components/responses/404NotFound'
        '500':
          $ref: '#/components/responses/500InternalServerError'
        '503':
          $ref: '#/components/responses/503ServiceUnavailable'
components:
  schemas:
    LargeShmRequest:
      description: A large /dev/shm device to mount into a container running the created workload. An shm is a shared file system mounted on RAM.
      type:
      - boolean
      - 'null'
      example: false
    SecretFieldsUpdatable:
      properties:
        mountPath:
          description: Local path within the workload to which the Secret will be mapped to. (mandatory)
          type:
          - string
          - 'null'
          minLength: 1
        defaultMode:
          $ref: '#/components/schemas/DefaultMode'
      type:
      - object
      - 'null'
    EnvironmentVariableConfigMap:
      description: Details of the configMap and key use to populate the environment variable
      properties:
        name:
          description: The name of the config-map resource. (mandatory)
          type:
          - string
          - 'null'
          minLength: 1
          example: my-config-map
          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
        key:
          description: The key in the config-map resource. (mandatory)
          type:
          - string
          - 'null'
          minLength: 1
          example: MY_POSTGRES_SCHEMA
          pattern: .*
      type:
      - object
      - 'null'
    ConfigMapInstance:
      allOf:
      - $ref: '#/components/schemas/StorageInstanceName'
      - $ref: '#/components/schemas/ConfigMap'
      - $ref: '#/components/schemas/ExcludeField'
      type:
      - object
      - 'null'
    WorkloadId2:
      description: A unique ID of the workload.
      type: string
      format: uuid
    Ports:
      description: Set of container ports that the workload exposes.
      type:
      - array
      - 'null'
      items:
        $ref: '#/components/schemas/Port'
    WorkspaceSpecSpec:
      allOf:
      - properties:
          annotations:
            $ref: '#/components/schemas/Annotations'
          args:
            $ref: '#/components/schemas/Args'
          autoDeletionTimeAfterCompletionSeconds:
            $ref: '#/components/schemas/AutoDeletionTimeAfterPreemption'
          backoffLimit:
            $ref: '#/components/schemas/BackoffLimit'
          category:
            $ref: '#/components/schemas/Category'
          command:
            $ref: '#/components/schemas/Command'
          compute:
            properties:
              cpuCoreLimit:
                $ref: '#/components/schemas/CpuCoreLimit'
              cpuCoreRequest:
                $ref: '#/components/schemas/CpuCoreRequest'
              cpuMemoryLimit:
                $ref: '#/components/schemas/CpuMemoryLimit'
              cpuMemoryRequest:
                $ref: '#/components/schemas/CpuMemoryRequest'
              extendedResources:
                $ref: '#/components/schemas/ExtendedResources'
              gpuDevicesRequest:
                $ref: '#/components/schemas/GpuDevicesRequest'
              gpuMemoryLimit:
                $ref: '#/components/schemas/GpuMemoryLimit'
              gpuMemoryRequest:
                $ref: '#/components/schemas/GpuMemoryRequest'
              gpuPortionLimit:
                $ref: '#/components/schemas/GpuPortionLimit'
              gpuPortionRequest:
                $ref: '#/components/schemas/GpuPortionRequest'
              gpuRequestType:
                $ref: '#/components/schemas/GpuRequestType'
              largeShmRequest:
                $ref: '#/components/schemas/LargeShmRequest'
            type:
            - object
            - 'null'
          createHomeDir:
            $ref: '#/components/schemas/CreateHomeDir'
          environmentVariables:
            $ref: '#/components/schemas/EnvironmentVariables'
          exposedUrls:
            $ref: '#/components/schemas/ExposedUrls'
          image:
            $ref: '#/components/schemas/Image'
          imagePullPolicy:
            $ref: '#/components/schemas/ImagePullPolicy'
          imagePullSecrets:
            $ref: '#/components/schemas/ImagePullSecrets'
          labels:
            $ref: '#/components/schemas/Labels'
          nodeAffinityRequired:
            $ref: '#/components/schemas/NodeAffinityRequired'
          nodePools:
            $ref: '#/components/schemas/NodePools'
          nodeType:
            $ref: '#/components/schemas/NodeType3'
          podAffinity:
            $ref: '#/components/schemas/PodAffinity'
          ports:
            $ref: '#/components/schemas/Ports'
          preemptibility:
            $ref: '#/components/schemas/Preemptibility'
          priorityClass:
            $ref: '#/components/schemas/PriorityClass'
          probes:
            $ref: '#/components/schemas/Probes'
          relatedUrls:
            $ref: '#/components/schemas/RelatedUrls'
          restartPolicy:
            $ref: '#/components/schemas/RestartPolicy'
          security:
            properties:
              allowPrivilegeEscalation:
                $ref: '#/components/schemas/AllowPrivilegeEscalation'
              capabilities:
                $ref: '#/components/schemas/Capabilities'
              hostIpc:
                $ref: '#/components/schemas/HostIpc'
              hostNetwork:
                $ref: '#/components/schemas/HostNetwork'
              readOnlyRootFilesystem:
                $ref: '#/components/schemas/ReadOnlyRootFileSystem'
              runAsGid:
                $ref: '#/components/schemas/RunAsGid'
              runAsNonRoot:
                $ref: '#/components/schemas/RunAsNonRoot'
              runAsUid:
                $ref: '#/components/schemas/RunAsUid'
              seccompProfileType:
                $ref: '#/components/schemas/SeccompProfileType'
              supplementalGroups:
                $ref: '#/components/schemas/SupplementalGroups'
              uidGidSource:
                $ref: '#/components/schemas/UidGidSource'
            type:
            - object
            - 'null'
          stdin:
            $ref: '#/components/schemas/Stdin'
          storage:
            properties:
              configMapVolume:
                $ref: '#/components/schemas/ConfigMapItems'
              dataVolume:
                $ref: '#/components/schemas/DataVolumeItems'
              emptyDirVolume:
                $ref: '#/components/schemas/EmptyDirItems'
              git:
                $ref: '#/components/schemas/GitItems'
              hostPath:
                $ref: '#/components/schemas/HostPathItems'
              nfs:
                $ref: '#/components/schemas/NfsItems'
              pvc:
                $ref: '#/components/schemas/PvcItems'
              s3:
                $ref: '#/components/schemas/S3Items'
              secretVolume:
                $ref: '#/components/schemas/SecretItems1'
            type:
            - object
            - 'null'
          terminateAfterPreemption:
            $ref: '#/components/schemas/TerminateAfterPreemption'
          terminationGracePeriodSeconds:
            $ref: '#/components/schemas/TerminationGracePeriod'
          tolerations:
            $ref: '#/components/schemas/Tolerations'
          tty:
            $ref: '#/components/schemas/Tty'
          workingDir:
            $ref: '#/components/schemas/WorkingDir'
        type:
        - object
        - 'null'
    GitAuthenticationMethod:
      description: Specifies the authentication method to use when accessing the Git repository. This is required for private repositories - `password` - Authenticate using a username and password. - `ssh-key` - Authenticate using an SSH private key.
      type: string
      minLength: 1
      example: password
      enum:
      - password
      - ssh-key
    HostIpc:
      description: Whether to enable host IPC. Defaults to false.
      type:
      - boolean
      - 'null'
      example: false
    DefaultMode:
      type:
      - string
      - 'null'
      description: 'File permission mode in octal string format. This value must be a 4-digit octal number, representing the default file mode when mounting a Secret or ConfigMap as a volume.

        '
      minLength: 4
      maxLength: 4
      example: '0644'
      pattern: 0[0-7]{3}
    CpuMemoryRequest:
      description: The amount of CPU memory to allocate for this workload (1G, 20M, .etc). The workload will receive at least this amount of memory. Note that the workload will not be scheduled unless the system can guarantee this amount of memory to the workload
      type:
      - string
      - 'null'
      pattern: ^([+]?[0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$
      example: 20M
    GpuDevicesRequest:
      description: Requested number of GPU devices. Currently if more than one device is requested, it is not possible to provide values for gpuMemory or gpuPortion.
      type:
      - integer
      - 'null'
      format: int32
      example: 1
      minimum: 0
    PriorityClass:
      description: 'Specifies the priority class for the workload, which determines its scheduling behavior. Valid values are: very-low, low, medium-low, medium, medium-high, high, and very-high. Each workload type has a default priority. To view the default priority for each workload type, use the GET /workload-types endpoint. Once you change the priority from the default value defined for that workload type, the preemptibility field is not automatically updated. Make sure to set the desired preemptibility value.'
      type:
      - string
      - 'null'
      pattern: .*
    Label:
      description: Label details to be populated into the container.
      properties:
        name:
          description: The name of the label (mandatory)
          type:
          - string
          - 'null'
          minLength: 1
          maxLength: 63
          example: stage
          pattern: .*
        value:
          description: The value of the label.
          type:
          - string
          - 'null'
          example: initial-research
          pattern: .*
        exclude:
          description: Use 'true' in case the label is defined in defaults of the policy, and you wish to exclude it from the workload.
          type:
          - boolean
          - 'null'
          example: false
      type:
      - object
      - 'null'
    SubmissionErrorV2:
      allOf:
      - $ref: '#/components/schemas/Error'
      - $ref: '#/components/schemas/ComplianceIssuesV2'
    GitSecretRef:
      properties:
        name:
          description: Name of the Secret containing the credentials of the repository.
          type: string
          minLength: 1
          example: my-password-secret
        authenticationMethod:
          $ref: '#/components/schemas/GitAuthenticationMethod'
        secretKeyOfUser:
          description: The key in the Secret that contains the Git username (used for `password` authentication).
          type:
          - string
          - 'null'
          minLength: 1
          example: User
        secretKeyOfPassword:
          description: The key in the Secret that contains the Git password (used for `password` authentication).
          type:
          - string
          - 'null'
          minLength: 1
          example: Password
      type:
      - object
      - 'null'
    DepartmentId2:
      description: The id of the department.
      type: string
      minLength: 1
      example: 2
      pattern: .*
    RelatedUrls:
      description: Set of URLs that are related to the workload.
      type:
      - array
      - 'null'
      items:
        $ref: '#/components/schemas/RelatedUrl'
    S3Instance:
      allOf:
      - $ref: '#/components/schemas/StorageInstanceName'
      - $ref: '#/components/schemas/S3Common'
      - $ref: '#/components/schemas/S3AccessKey'
      - $ref: '#/components/schemas/ExcludeField'
      type:
      - object
      - 'null'
    NodeSelectorTerm:
      type:
      - object
      - 'null'
      description: A null or empty node selector term matches no objects. The requirements of them are ANDed.
      properties:
        matchExpressions:
          description: A list of node selector requirements by node's labels.
          type: array
          items:
            $ref: '#/components/schemas/MatchExpression'
    GitCommon:
      properties:
        repository:
          description: URL to a remote Git repository. The content of this repository will be mapped to the container running the workload. (mandatory)
          type:
          - string
          - 'null'
          minLength: 1
          example: https://github.com/my-git/my-repo
        branch:
          description: Specific branch to synchronize the repository from.
          type:
          - string
          - 'null'
          minLength: 1
          example: main
        revision:
          description: Specific revision to synchronize the repository from.
          type:
          - string
          - 'null'
          minLength: 1
        path:
          description: Local path within the workload to which the Git repository will be mapped (mandatory).
          type:
          - string
          - 'null'
          minLength: 1
          example: /container/my-repository
      type:
      - object
      - 'null'
    ImagePullSecrets:
      description: A list of references to Kubernetes secrets in the same namespace used for pulling container images.
      type:
      - array
      - 'null'
      items:
        $ref: '#/components/schemas/ImagePullSecret'
    PvcVolumeMode:
      description: Default volume mode for the PVC. Choose between Filesystem (default) or Block.
      type:
      - string
      - 'null'
      enum:
      - Filesystem
      - Block
    WorkspaceSpec:
      description: The specifications of the workspace to be created.
      properties:
        spec:
          $ref: '#/components/schemas/WorkspaceSpecSpec'
    TolerationEffect:
      description: The taint effect to match. (mandatory)
      type:
      - string
      - 'null'
      enum:
      - NoSchedule
      - NoExecute
      - PreferNoSchedule
      - Any
    Annotation:
      description: Annotation details to be populated into the container.
      properties:
        name:
          description: The name of the annotation (mandatory)
          type:
          - string
          - 'null'
          minLength: 1
          maxLength: 63
          example: billing
          pattern: .*
        value:
          description: The value of the annotation.
          type:
          - string
          - 'null'
          example: my-billing-unit
          pattern: .*
        exclude:
          description: Use 'true' in case the annotation is defined in defaults of the policy, and you wish to exclude it from the workload.
          type:
          - boolean
          - 'null'
          default: false
          example: false
      type:
      - object
      - 'null'
    NodeType3:
      description: Nodes (machines), or a group of nodes on which the workload will run. To use this feature, your Administrator will need to label nodes. For more information, see [Group Nodes](https://docs.run.ai/latest/admin/researcher-setup/limit-to-node-group). When using this flag with with Project-based affinity, it refines the list of allowable node groups set in the Project. For more information, see [Projects](https://docshub.run.ai/guides/platform-management/aiinitiatives/organization/projects).
      type:
      - string
      - 'null'
      minLength: 1
      example: my-node-type
      pattern: .*
    HostPath:
      properties:
        path:
          description: Local path within the controller to which the host volume will be mapped. (mandatory)
          type:
          - string
          - 'null'
          minLength: 1
          example: /container/directory
          pattern: .*
        readOnly:
          description: Force the volume to be mounted with read-only permissions. Defaults to false.
          type:
          - boolean
          - 'null'
          default: true
        mountPath:
          description: The path that the host volume will be mounted to when in use. (mandatory)
          type:
          - string
          - 'null'
          minLength: 1
          example: /local/directory
          pattern: .*
        mountPropagation:
          $ref: '#/components/schemas/HostPathMountPropagation'
      type:
      - object
      - 'null'
    PvcClaimSize:
      description: 'Requested size for the PVC. Mandatory when existingPvc is false. Recommended sizes: TB/GB/MB/TIB/GIB/MIB'
      type:
      - string
      - 'null'
      pattern: ^([+]?[0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$
      example: 1G
    ExposedUrls:
      description: Set of container ports that the workload exposes via URLs.
      type:
      - array
      - 'null'
      items:
        $ref: '#/components/schemas/ExposedUrl'
    EnvironmentVariablePodFieldReference:
      description: Details of the field-reference and key use to populate the environment variable
      properties:
        path:
          description: The field path resource. (mandatory)
          type:
          - string
          - 'null'
          minLength: 1
          example: metadata.name
          pattern: .*
      type:
      - object
      - 'null'
    Labels:
      description: Set of labels to populate into the container running the workload.
      type:
      - array
      - 'null'
      items:
        $ref: '#/components/schemas/Label'
    PvcFieldsNonUpdatable:
      properties:
        existingPvc:
          description: Verify existing PVC. PVC is assumed to exist when set to `true`. If set to `false`, the PVC will be created, if it does not exist.
          type:
          - boolean
          - 'null'
          default: false
        claimName:
          description: Name for the PVC. Allow referencing it across workloads. If not provided, a name based on the workload name and scope will be auto-generated.
          type:
          - string
          - 'null'
          minLength: 1
          maxLength: 63
          example: my-claim
          pattern: .*
        readOnly:
          description: Permit only read access to PVC.
          type:
          - boolean
          - 'null'
          default: false
        ephemeral:
          description: Use `true` to set PVC to ephemeral. If set to `true`, the PVC will be deleted when the workload is stopped. Not supported for inference workloads.
          type:
          - boolean
          - 'null'
          default: false
          example: false
        claimInfo:
          $ref: '#/components/schemas/ClaimInfo'
        dataSharing:
          description: use `true` to share the PVC data to all projects under the selected scope.
          type:
          - boolean
          - 'null'
          default: false
          example: false
      type:
      - object
      - 'null'
    TerminateAfterPreemption:
      description: Indicates if the job should be terminated by the system after it has been preempted.
      type:
      - boolean
      - 'null'
      example: false
    Preemptibility:
      description: Specifies whether the workload can be preempted by higher-priority workloads. Valid values are preemptible and non-preemptible. If explicitly set, this value takes precedence. If not set, the system derives the preemptibility from the priorityClassName field, ensuring backward compatibility. Each workload type has a default preemptibility. To view the default preemptibility for each workload type, use the GET /workload-types endpoint.
      type:
      - string
      - 'null'
      minLength: 1
      enum:
      - preemptible
      - non-preemptible
    GitItems:
      description: Set of git repositories to use in the workload.
      type:
      - array
      - 'null'
      items:
        $ref: '#/components/schemas/GitInstance'
    PvcAddedAttrValues:
      description: an optional array of key-values pairs that are written as annotations on the created PVC. the allowed attributes are determined according to the storage class configuration (see k8s-objects-tracker for further info).
      type: array
      items:
        $ref: '#/components/schemas/PvcAddedAttrValue'
    RunAsUid:
      description: The user id to run the entrypoint of the container which executes the workspace. Default to the value specified in the environment asset `runAsUid` field (optional). Use only when the source uid/gid of the environment asset is not `fromTheImage`, and `overrideUidGidInWorkspace` is enabled.
      type:
      - integer
      - 'null'
      format: int64
      example: 500
    StorageInstanceName:
      properties:
        name:
          description: unique name to identify the instance. primarily used for policy locked rules.
          type:
          - string
          - 'null'
          minLength: 1
          example: storage-instance-a
      type:
      - object
      - 'null'
    WorkloadCreationMeta:
      required:
      - name
      - projectId
      - clusterId
      properties:
        name:
          $ref: '#/components/schemas/WorkloadName'
        useGivenNameAsPrefix:
          description: When true, the requested name will be treated as a prefix. The final name of the workload will be composed of the name followed by a random set of characters.
          type: boolean
          example: true
          default: false
        projectId:
          $ref: '#/components/schemas/ProjectId'
        clusterId:
          $ref: '#/components/schemas/ClusterId'
    AuthorizationType:
      type:
      - string
      - 'null'
      enum:
      - authenticatedUsers
      - authorizedUsers
      - authorizedGroups
      description: 'Specifies who can access the connection URL:

        - `authenticatedUsers`: Any authenticated user or service account can access the URL; the authorizedUsers and authorizedGroups fields are ignored.

        - `authorizedUsers`: Only users listed in the authorizedUsers field are allowed to access the URL; the authorizedGroups field is ignored.

        - `authorizedGroups`: Only members of user groups listed in the authorizedGroups field are allowed to access the URL; the authorizedUsers field is ignored.

        If not specified, authorization is determined by whether authorizedUsers or authorizedGroups is present. If both fields are set, this results in an error. If neither is set, any authenticatedUser can access.

        '
    WorkloadName:
      description: The name of the workload.
      type: string
      minLength: 1
      example: my-workload-name
      pattern: .*
    Image:
      description: Docker image name. For more information, see [Images](https://kubernetes.io/docs/concepts/containers/images). The image name is mandatory for creating a workload.
      type:
      - string
      - 'null'
      minLength: 1
      example: python:3.8
      pattern: .*
    SeccompProfileType:
      description: Indicates which kind of seccomp profile will be applied to the container. The options are a. `RuntimeDefault` - the container runtime default profile should be used. b. `Unconfined` - no profile should be applied. c. `Localhost` is not yet supported by Run:ai.
      type:
      - string
      - 'null'
      enum:
      - RuntimeDefault
      - Unconfined
      - Localhost
    EnvironmentVariable:
      description: Details of an environment variable which is populated into the container.
      properties:
        name:
          description: The name of the environment variable. (mandatory)
          type:
          - string
          - 'null'
          minLength: 1
          example: HOME
          pattern: .*
        value:
          description: The value of the environment variable. (mutually exclusive with secret, userCredential, configMap and podFieldRef)
          type:
          - string
          - 'null'
          example: /home/my-folder
          pattern: .*
        secret:
          $ref: '#/components/schemas/EnvironmentVariableSecret'
        configMap:
          $ref: '#/components/schemas/EnvironmentVariableConfigMap'
        podFieldRef:
          $ref: '#/components/schemas/EnvironmentVariablePodFieldReference'
        userCredential:
          $ref: '#/components/schemas/EnvironmentVariableUserCredential'
        exclude:
          description: Use 'true' in case the environment variable is defined in defaults of the policy, and you wish to exclude it from the workload.
          type:
          - boolean
          - 'null'
          example: false
        description:
          description: Description of the environment variable.
          type:
          - string
          - 'null'
          example: Home directory of the user.
          pattern: .*
      type:
      - object
      - 'null'
    PvcAccessModes:
      description: Default access mode(s) applied to newly created PVCs unless explicitly overridden.
      properties:
        readWriteOnce:
          description: Mount the volume as read/write by a single node.
          type:
          - boolean
          - 'null'
          default: true
        readOnlyMany:
          description: Mount the volume as read-only by many nodes.
          type:
          - boolean
          - 'null'
          default: false
        readWriteMany:
          description: Mount the volume as read/write by many nodes.
          type:
          - boolean
          - 'null'
          default: false
      type:
      - object
      - 'null'
    NfsItems:
      description: Set of nfs volumes to use in the workload.
      type:
      - array
      - 'null'
      items:
        $ref: '#/components/schemas/NfsInstance'
    EnvironmentVariables:
      description: Set of environment variables to populate into the container running the workload.
      type:
      - array
      - 'null'
      items:
        $ref: '#/components/schemas/EnvironmentVariable'
    AllowPrivilegeEscalation:
      description: Allow the container running the workload and all launched processes to gain additional privileges after the workload starts. For more information consult the User Identity in Container guide at https://docs.run.ai/admin/runai-setup/config/non-root-c

# --- truncated at 32 KB (76 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/runai/refs/heads/main/openapi/runai-workspaces-api-openapi.yml