Delete a workspace

Deletes an empty workspace, and in the same step REVOKES every API key confined to it, whoever holds them: a key has nothing left to reach once its workspace is gone, and it is never widened to the account instead. The answer says how many were revoked. Owners only, with an account-wide API key: a key confined to a workspace is refused (403), its own workspace included.

Webhook subscriptions confined to the workspace (those created with a key scoped to it) are deleted with it in the same step, with every delivery record they hold, pending ones included, as DELETE /webhooks/{id} does; the answer does not count them. Account-wide subscriptions are not affected.

A workspace that still holds computers cannot be deleted: the answer is 409 with reason: "unsupported", saying how many, and nothing is deleted or revoked. The count includes a computer whose unfinished workspace change is moving it into this workspace. Move those computers with PUT /computers/{id}/workspace or in the dashboard, or delete them, first. When the platform cannot confirm the workspace is empty because part of it did not answer, the answer is 503, also with nothing deleted; try again shortly.

A workspace holding active secrets also answers 409 with reason: "unsupported", saying how many. Delete those secrets explicitly with DELETE /secrets/{id} first, using their workspace_id and current revision_id, then retry. The refusal preserves the workspace, its keys and all secret data. Deleted secrets do not block workspace deletion. Deleting a secret frees an active slot but does not reduce the lifetime count of 1000 created secrets.

This safeguard prevents new orphan secrets; it does not repair secrets orphaned by older workspace deletions. Those remain unreachable: listing or creating with a deleted workspace_id is a 400, and reading, replacing or deleting one of its secrets is a 404. They still count toward the 100 active secrets per account.

Snapshots taken in it are kept. An account-wide key or the dashboard can still clone them: a clone built from the disk (a disk snapshot, or memory: false) lands in no workspace, and one that would resume a memory snapshot’s session is refused with 409 (see POST /snapshots/{id}/clone).

Requires the owner role or higher.