workspace-code-execution-policy

Set Workspace Code Execution Policy

Changed on

Set a workspace's code-execution policy, replacing any existing one.

An organization owner/admin, or an owner/admin of this workspace, may write it. The policy can only narrow what the deployment permits: turning code execution off for the workspace, lowering the loop and execution ceilings, and removing tool kinds from what the sandbox backend serves. It never turns a sandbox the deployment has not configured on, and image may only name one the operator curated (allowed_images on the response reports the set); anything else is refused with 400.

put/api/v1/workspaces/{workspace_id}/code-execution-policy

Request

  • The document declares no server URL.
  • Auth: one of:
    • API key in header Otari-Key
    • API key in header x-api-key

Path parameters

workspace_idstring uuid required

Request body

default_purpose_hintstring nullable

Hint used when a request declares otari_code_execution without one of its own

enabledboolean required

False refuses code execution for this workspace

exec_timeout_sinteger nullable

Ceiling on one execution's runtime in seconds; only ever lowers the effective limit, so at most 60

executor'auto' | 'otari' | 'provider'

Who runs the code a request's code-execution tool asks for.

Values are read without regard to case or surrounding whitespace.

imagestring nullable

Sandbox image this workspace's code runs in. Must be one the operator curated into sandbox_allowed_session_images (or the deployment's own sandbox_session_image); null uses the deployment's

max_iterationsinteger nullable

Ceiling on tool-loop iterations; only ever lowers the effective limit, so at most 25

toolsstring[] nullable

Code-execution tool kinds this workspace may use, from code_execution, bash_code_execution, text_editor_code_execution. Only ever removes one the backend serves; null exposes whatever it serves

Response

Successful Response

allowed_imagesstring[] required
available_toolsstring[] required
configuredboolean required
created_atstring nullable required
default_enabledboolean required
default_purpose_hintstring nullable required
enabledboolean required
exec_timeout_sinteger nullable required
executor'auto' | 'otari' | 'provider' required

Who runs the code a request's code-execution tool asks for.

Values are read without regard to case or surrounding whitespace.

imagestring nullable required
max_iterationsinteger nullable required
sandbox_configuredboolean required
toolsstring[] nullable required
updated_atstring nullable required
workspace_idstring uuid required

Changes