Organizations, workspaces and regions

The machine prefix is /api/v1/organizations/{organizationSlug}/workspaces/{workspaceSlug}. The combined host strips /api before forwarding to the regional API; an explicitly verified direct cell origin uses /v1 instead. Do not append /api twice.

The app prefix is /org/{organizationSlug}/workspace/{workspaceSlug}. Copy the current pair from the app or use the portal's verified workspace selector when available. Choose that workspace's verified API origin; do not invent cell hostnames from region names. Anonymous examples use placeholders.

Slugs are namespaced and may change. Retired machine slugs return generic 404 without a credential-bearing redirect. Resolve the current pair in the app and update server configuration. Combining a valid organization with another organization's workspace also gives 404 without disclosing foreign existence.

Discover client/project UUIDs via Getting started. Every nested entity must belong to the selected workspace and parent. Signed-in route hints do not bypass independent API authentication, current creator membership, role, routing or RLS.

Organization/workspace lifecycle, provisioning, membership and provider consent remain app workflows. Customer keys are not organization administration credentials.