---
title: "Set Workspace Code Execution Policy"
method: PUT
path: "/v1/workspaces/{workspace_id}/code-execution-policy"
tags: ["workspace-code-execution-policy"]
---

# Set Workspace Code Execution Policy

`PUT /v1/workspaces/{workspace_id}/code-execution-policy`

Set a workspace's code-execution policy, replacing any existing one.

An organization owner/admin, or an owner/admin of this workspace, may
write it. The policy can only narrow what the deployment permits: turning
code execution off for the workspace, lowering the loop and execution
ceilings, and removing tool kinds from what the sandbox backend serves. It
never turns a sandbox the deployment has not configured on, and ``image``
may only name one the operator curated (``allowed_images`` on the response
reports the set); anything else is refused with 400.

## Path parameters

- `workspace_id` string, uuid, required

## Request body

- WorkspaceCodeExecutionPolicyUpdate — The policy to store for a workspace, as a whole. ``PUT`` semantics, ported from the hosted ``CodeExecutionConfigUpsert``: what is sent is what the workspace has afterwards, so an omitted limit is cleared rather than left as it was.
  - `default_purpose_hint` string, nullable — Hint used when a request declares otari_code_execution without one of its own
  - `enabled` boolean, required — False refuses code execution for this workspace
  - `exec_timeout_s` integer, nullable — Ceiling on one execution's runtime in seconds; only ever lowers the effective limit, so at most 60
  - `image` string, nullable — Sandbox image this workspace's code runs in. Must be one the operator curated into sandbox_allowed_session_images (or the deployment's own sandbox_session_image); null uses the deployment's
  - `max_iterations` integer, nullable — Ceiling on tool-loop iterations; only ever lowers the effective limit, so at most 25
  - `tools` string[], nullable — Code-execution tool kinds this workspace may use, from code_execution, bash_code_execution, text_editor_code_execution. Only ever removes one the backend serves; null exposes whatever it serves

## Response `200`

Successful Response

- WorkspaceCodeExecutionPolicyPublic — A workspace's policy, or the unconfigured policy it has without one.
  - `allowed_images` string[], required
  - `available_tools` string[], required
  - `configured` boolean, required
  - `created_at` string, nullable, required
  - `default_purpose_hint` string, nullable, required
  - `enabled` boolean, required
  - `exec_timeout_s` integer, nullable, required
  - `image` string, nullable, required
  - `max_iterations` integer, nullable, required
  - `sandbox_configured` boolean, required
  - `tools` string[], nullable, required
  - `updated_at` string, nullable, required
  - `workspace_id` string, uuid, required

## Other responses

- `422` — Validation Error

## Changes

- **2026-08-25** `0e52dff6b641` — 6 info
  - added the new optional request property `image`
  - added the new optional request property `tools`
  - added the required property `allowed_images` to the response with the `200` status
  - added the required property `available_tools` to the response with the `200` status
  - …2 more
- **2026-08-25** `1725b1abe9a0` — 4 breaking, 2 warning
  - removed the required property `allowed_images` from the response with the `200` status
  - removed the required property `available_tools` from the response with the `200` status
  - removed the required property `image` from the response with the `200` status
  - removed the required property `tools` from the response with the `200` status
  - …2 more
- **2026-08-24** `6d9979b0b62b` — 6 info
  - added the new optional request property `image`
  - added the new optional request property `tools`
  - added the required property `allowed_images` to the response with the `200` status
  - added the required property `available_tools` to the response with the `200` status
  - …2 more
- **2026-08-24** `961e73dbaf8b` — 1 info
  - endpoint added
- **2026-08-21** `2f89238cc674` — 1 breaking
  - api path removed without deprecation

[Full history](https://skmtc.dev/mozilla-ai/apis/otari/changes/v1/workspaces/:workspace_id/code-execution-policy/put.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/eae05f7dd3cd/schema)