REST reference · v1

Set exact service permissions

PUT/v1/workspaces/{workspaceId}/service-permissions/{provider}/{environment}

Designated global access administrator only, for an existing active/invited company member. Exact production/sandbox grant overrides the * default; empty actions deny access. Does not assign company membership.

Company permissions

Required OAuth scopes: orchesphere.read, orchesphere.manage. How scopes and company rights work.

Path and header parameters

Name	Location	Required	Allowed values / bounds
`workspaceId`	path	Yes	`string` minLength: 8 · maxLength: 80 · pattern: ^[A-Za-z0-9_-]{8,80}$
`provider`	path	Yes	"quickbooks" \| "netsuite" \| "stripe" \| "paypal" \| "payoneer" \| "us-bank" \| "bank-accounts" \| "plaid" \| "avalara" \| "track1099" \| "thomson-reuters" \| "xero" \| "sage" \| "freshbooks" \| "zoho-books" \| "bill" \| "ramp" \| "brex" \| "expensify" \| "gusto" \| "rippling" \| "square" \| "chargebee" \| "recurly" \| "pipe17" \| "magento" \| "shopify" \| "bigcommerce" \| "salsify" \| "amazon" \| "walmart" \| "ebay" \| "channelengine" \| "mirakl" \| "chewy" \| "sellerboard" \| "sps" \| "netsuite-connector" \| "gs1" \| "orderful" \| "woocommerce" \| "commercetools" \| "prestashop" \| "etsy" \| "tiktok-shop" \| "faire" \| "rithum" \| "klaviyo" \| "amazon-ads" \| "google-ads" \| "shipbob" \| "shipstation" \| "flavorcloud" \| "aftership" \| "ups" \| "fedex" \| "dhl" \| "usps" \| "easypost" \| "shippo" \| "easyship" \| "flexport" \| "dsv" \| "shiphero" \| "entra" \| "sharepoint" \| "onedrive" \| "teams" \| "outlook" \| "outlook-calendar" \| "exchange-fur4" \| "exchange-platformz" \| "google-workspace" \| "jira" \| "confluence" \| "slack" \| "notion" \| "asana" \| "linear" \| "airtable" \| "ipostal" \| "clickup" \| "monday" \| "trello" \| "smartsheet" \| "basecamp" \| "zoom" \| "dropbox" \| "box" \| "docusign" \| "pandadoc" \| "figma" \| "canva" \| "miro" \| "hubspot" \| "salesforce" \| "zendesk" \| "servicenow" \| "mailchimp" \| "mandrill" \| "twilio" \| "sendgrid" \| "brandfolder" \| "strapi" \| "google-analytics" \| "intercom" \| "helpscout" \| "freshdesk" \| "zoho-crm" \| "pipedrive" \| "activecampaign" \| "constant-contact" \| "customer-io" \| "aws" \| "cloudflare" \| "google-cloud" \| "new-relic" \| "plerion" \| "postman" \| "github" \| "azure" \| "digitalocean" \| "vercel" \| "netlify" \| "supabase" \| "firebase" \| "sentry" \| "datadog" \| "grafana" \| "gitlab" \| "bitbucket" \| "docker" \| "snowflake" \| "databricks" \| "bigquery" \| "redshift" \| "mongodb" \| "postgresql" \| "mysql" \| "tableau" \| "power-bi" \| "looker" \| "fivetran" \| "airbyte" \| "dbt" \| "segment" \| "openai" \| "anthropic" \| "gemini" \| "bedrock" \| "azure-openai" \| "perplexity" \| "cohere" \| "hugging-face" \| "elevenlabs" \| "heygen" \| "cursor" pattern: ^[a-z0-9][a-z0-9-]{1,63}$
`environment`	path	Yes	`"production" \| "sandbox" \| "*"`

Request

JSON body: required.

Field	Type	Required	Description / bounds
`email`	`string`	Yes	minLength: 3 · maxLength: 254 · format: email
`actions`	`array`	Yes	Nonempty actions require read. jobs_cancel_all requires jobs_read_all. Empty array denies access. Viewer members may receive read-only actions only. · maxItems: 5

Complete request schema

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email",
      "minLength": 3,
      "maxLength": 254
    },
    "actions": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "read",
          "verify",
          "configure",
          "jobs_read_all",
          "jobs_cancel_all"
        ]
      },
      "uniqueItems": true,
      "maxItems": 5,
      "description": "Nonempty actions require read. jobs_cancel_all requires jobs_read_all. Empty array denies access. Viewer members may receive read-only actions only."
    }
  },
  "required": [
    "email",
    "actions"
  ],
  "additionalProperties": false
}

http

PUT /v1/workspaces/{workspaceId}/service-permissions/{provider}/{environment} HTTP/1.1
Host: api.orchesphere.ai
Authorization: Bearer <access_token>
Accept: application/json
Content-Type: application/json

{
  "email": "developer@example.com",
  "actions": [
    "read",
    "verify"
  ]
}

Use actual IDs returned for your assigned workspace. The example values are fictional. REST v1 accepts no query parameters.

Response · 200

Field	Type	Required	Description / bounds
`ok`	`object`	Yes	—

Complete response schema

{
  "type": "object",
  "properties": {
    "ok": {
      "const": true
    }
  },
  "required": [
    "ok"
  ],
  "additionalProperties": false
}

json

{
  "ok": true
}

Errors

Status	Meaning
`400`	Invalid path/query/body/header or business validation.
`401`	Missing, expired, revoked, invalid or wrong-resource token.
`402`	Verified company payment is required.
`403`	Insufficient token scope or current company/service/portal/task authority.
`404`	Unknown endpoint or record not found/inaccessible.
`405`	Method is not supported for this path.
`409`	State, quota or idempotency conflict; re-read current state.
`413`	Request exceeds 24,000 bytes.
`415`	Use uncompressed application/json.
`429`	Company job/rate/paid-period allowance reached.
`503`	Temporarily unavailable; a lost mutation response does not prove nothing was saved.

Request limits and recovery · All REST operations