# Workspaces Call `GET /api/organizations` first. It returns the `id`, `name`, `slug` and `logo` of every workspace you belong to. `GET /api/members` lists visible members across those workspaces; use `?workspace=` to narrow it to one. Routes under `/api/organizations/{workspaceId}` take one of those ids. Any member can read these routes, and changing plugins, skills or integrations needs the owner or admin role. | Method | Path | Description | | ------ | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | POST | `/api/agent-integrations/execute?workspace=` | Run one integration tool. An agent runs it for its own workspace, or on the member’s personal connection in any of their Sensei Turns or a session turn that member started. With an API key, name a workspace you belong to: the call runs only on your own personal connections, and one on a workspace connection is refused. The answer names the connection it ran on, or lists the connections to choose from when the call needs one. A tool failure answers 200 with isError true. Some integrations require an enabled workspace to be named. A Connector Token or a browser session is refused. | | POST | `/api/agent-integrations/file-uploads?workspace=` | Reserve the upload of one file for an integration tool that takes files, on the connection a call would run on. The answer is a file reference and a URL: PUT the file to the URL with the headers given, then pass the reference as the file argument of that tool on that connection. `kosuke integrations call --file` does all of it, and is the command to use. A failure answers 200 with isError true, as a call does. A Connector Token or a browser session is refused. | | POST | `/api/agent-integrations/requests?workspace=` | Send one request straight to a Composio toolkit’s own API through a connection you reach, for an action no listed tool does. Composio adds the credentials on the server. It follows the same connection rules, write checks and rate limit as a tool call. Refused before any vendor call: a toolkit that is not Composio’s or is limited to its reviewed tools, DELETE, headers, an absolute URL and a path with %, .. or an empty segment. With an API key it runs only on your own personal connections. A vendor’s refusal answers 200 with isError true. | | GET | `/api/agent-integrations/tools?workspace=&view=&toolkit=&search=&name=&account=&limit=` | List the integration tools you can run now, with the connections that run them. An agent reads its own workspace. With an API key, name a workspace you belong to: it shows that workspace’s connections and your own personal ones. Some integrations require an enabled workspace to be named. A Connector Token or a browser session is refused. Each toolkit is personal or workspace, never both. A personal connection reaches every Sensei Turn of its member, and a session turn its member started (in a workspace chat, only the session's Assignee); a workspace Cron, Deploy Chat, a Turn another member sent and unassigned work reach workspace connections only. In the Personal space the owner's own Turns reach both kinds. | | GET | `/api/members?workspace=` | List visible members across every workspace you belong to. Each roster names its workspace. An agent token reads its own workspace only. | | GET | `/api/organizations` | List the workspaces you belong to. | | GET | `/api/organizations/{workspaceId}` | Read one workspace, your role in it, and its timezone, the one every cron is read in. | | GET | `/api/organizations/{workspaceId}/access-status?scope=` | Read which providers you, or the workspace, can run. | | GET | `/api/organizations/{workspaceId}/artifacts/search?q=` | Spotlight and the command palette now find these through Files search. Search the files agents wrote in a workspace by title, across its Chat Sessions and its Cron Runs. | | GET | `/api/organizations/{workspaceId}/credits` | Read the credit balance and limit of a workspace. | | GET | `/api/organizations/{workspaceId}/files?folder=` | List a workspace folder by id or path, with its breadcrumb and items, folders first. Omit folder for the root. | | POST | `/api/organizations/{workspaceId}/files` | Put a file by path, creating parent folders and replacing an existing file. Send text or exactly one attachment, at most 25 MiB. ifVersion refuses a stale replace. Alternatively provide name and parentId (null for the root). | | GET | `/api/organizations/{workspaceId}/files/{fileId}` | Get a workspace item. Text up to 1 MiB includes body; other files include downloadUrl and expiresAt. url always opens the item in Files. | | PATCH | `/api/organizations/{workspaceId}/files/{fileId}` | Rename a workspace item with name, move it with parentId (null for the root), or both. Name clashes and moving a folder into its descendants are refused. Folders Kosuke keeps and locked files refuse with 403. | | DELETE | `/api/organizations/{workspaceId}/files/{fileId}` | Delete a workspace file, or a folder and every item inside it. Agents cannot delete Files. Folders Kosuke keeps and locked files refuse with 403. | | POST | `/api/organizations/{workspaceId}/files/folders` | Create a workspace folder and its missing parents. An existing folder is returned unchanged; a file with the same name is refused. | | GET | `/api/organizations/{workspaceId}/grok` | Read the workspace Grok connection labels and active method. Members only. | | POST | `/api/organizations/{workspaceId}/grok` | Connect, select, poll, cancel or remove workspace Grok access. Owners and admins only. | | GET | `/api/organizations/{workspaceId}/integrations?view=&toolkit=` | List the workspace's integrations with their status: every toolkit this deployment offers and every one the workspace still holds. Never a credential or a connected-account identifier. | | GET | `/api/organizations/{workspaceId}/integrations/{toolkit}` | Read one workspace integration by toolkit slug, such as sentry: status, the tenant it is confined to, requested scopes, who authorized it, whether remote cleanup is pending and each of its connections. Never a credential or a connected-account identifier. A toolkit the workspace never connected and this deployment does not offer is a 404. | | DELETE | `/api/organizations/{workspaceId}/integrations/{toolkit}` | Disconnect an integration by toolkit slug: agents lose the workspace's access at once, then the platform deletes the stored authorization, retrying in the background if needed. Revoking the authorization at the toolkit itself is not part of this. Admins only. | | GET | `/api/organizations/{workspaceId}/labels` | List the label names across a workspace's repositories, for the tasks list's labels filter. | | GET | `/api/organizations/{workspaceId}/members?includeInvitations=` | List the members of a workspace, and its pending invitations unless excluded. | | GET | `/api/organizations/{workspaceId}/personal-runtime` | Read Personal actual runtime balance and shared sandbox capacity. | | GET | `/api/organizations/{workspaceId}/plugins?provider=` | List the plugins the Official Marketplaces offer, Anthropic's for Claude and OpenAI's for Codex, or one Provider's with provider=anthropic or provider=openai, with whether the workspace has each on and the last failed install in its chat sessions. Plugins that carry MCP servers or ChatGPT apps are not offered. Workspace plugins are installed in every chat session of the workspace. | | PATCH | `/api/organizations/{workspaceId}/plugins/{pluginId}` | Turn a workspace plugin on or off by its plugin@marketplace id, as the list returns it. Running chat sessions install or remove it at their next turn. Admins only. Answers 204. | | GET | `/api/organizations/{workspaceId}/sandbox-hours` | Read organization sandbox hours and stop status. | | GET | `/api/organizations/{workspaceId}/sandbox-limit` | Read how many sandboxes may run at once, which sessions are running now, and every sandbox that holds a slot. | | GET | `/api/organizations/{workspaceId}/skills` | List the workspace's custom skills: what each SKILL.md declares, how many files the skill holds, and whether it is enabled. The platform's own skills are not listed: every chat session carries them, always on, as kosuke:. | | POST | `/api/organizations/{workspaceId}/skills` | Add a custom skill from its files. A SKILL.md is required; its frontmatter carries the kebab-case name, the description and an optional argument-hint. Text files only, 100 KiB each, 50 files and 1 MiB in all. Admins only. Answers 201 with the id of the new skill. | | GET | `/api/organizations/{workspaceId}/skills/{skillId}` | Get one custom skill with every file it holds, SKILL.md included. | | PATCH | `/api/organizations/{workspaceId}/skills/{skillId}` | Enable or disable a custom skill, or replace every file it holds; at least one of enabled and files. Admins only. Answers 204. | | DELETE | `/api/organizations/{workspaceId}/skills/{skillId}` | Delete a custom skill and its files. Admins only. | | POST | `/api/organizations/{workspaceId}/stop-sandboxes` | Pause the sandboxes of the given chat sessions. | | PUT | `/api/organizations/{workspaceId}/timezone` | Set the Workspace Timezone, the IANA zone every cron of the workspace is read and shown in, e.g. Europe/Rome. Each enabled cron's next run moves to the new zone, except one already due, which fires on its slot. Refused, naming the crons, when any cron would fire more often than every 15 minutes or never in the new zone; nothing changes then. Sending the zone already set changes nothing. Owners and admins only. | | GET | `/api/organizations/{workspaceId}/usage?start=&end=&tz=` | Read sandbox usage by day and by project. The days are the UTC dates from start up to end, each read from midnight to midnight in tz (an IANA time zone, your own time zone by default). start must precede end and the range is capped at 366 days. 400 on an unknown time zone. | | GET | `/api/organizations/{workspaceId}/usage/breakdown?range=&tz=` | Read what used the workspace's Credentials over range (7d by default, 30d or all) in calendar days of tz (an IANA time zone, UTC by default; the kosuke CLI sends your own timezone): totals and per-day counts, then rows grouped by work, repository and model, each with its Providers and busiest Chat Sessions (the top five by every count, so sort by the one you show). Counts attempts run on the workspace's Credentials since recording began on 22 October 2026; days before it have recorded false and are never 0. turns counts every attempt; the four token counts are sums of reported counts only, never added together, with missing and inProgress counted apart. Members' own Subscriptions, Sensei, Sensei free and platform work are excluded. Owners and admins only. 400 on another range or an unknown time zone. | The API calls a workspace `organization`, which is why these paths start with `/api/organizations`. ## Find your workspace id List the workspaces you belong to, oldest membership first. ```bash curl -s https://app.kosuke.ai/api/organizations \ -H "Authorization: Bearer $KOSUKE_API_KEY" ``` ```json { "data": [ { "id": "YzH4k2P9sQ1mVx7bN3cR8tL5wD0fG6jA", "name": "Acme", "slug": "acme-4f1c9a2e", "logo": null } ] } ``` `GET /api/organizations/{workspaceId}` reads one workspace. It returns `id`, `name`, `logo`, `createdAt`, `role`, your own role in that workspace (`owner`, `admin` or `member`), and `timezone`, the Workspace Timezone. In the CLI, run `kosuke workspaces list` and `kosuke workspaces get `. ## Set the Workspace Timezone Every cron of a workspace is read and shown in one IANA zone, the Workspace Timezone. A workspace starts on `UTC`. Owners and admins change it with `PUT /api/organizations/{workspaceId}/timezone`. Members get `403`. ```bash curl -s -X PUT "https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/timezone" \ -H "Authorization: Bearer $KOSUKE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"timezone": "Europe/Rome"}' ``` The answer is `{ "data": { "timezone": "Europe/Rome" } }`. In the CLI, run `kosuke workspaces timezone set --timezone Europe/Rome`. Each enabled cron's next run moves to the next fire in the new zone. A cron that is already due keeps its slot and fires first. Sending the zone already set changes nothing. The request answers `400` for a zone `Intl` does not know, and for a zone in which any cron would fire more often than every 15 minutes or never. That message names those crons, and nothing changes. ## Check provider access Find out whether a chat session can start before you create one. `canAccess: false` means Sensei refuses to start a session for whoever the `scope` describes. | `scope` | Reports | `canAccess: false` means | | --- | --- | --- | | `member` (the default) | What you can run in this workspace. A provider runs on your Subscription when you hold one, otherwise on the workspace's Credentials. | You cannot start chat sessions here until you connect a Subscription or an admin configures Credentials. | | `workspace` | What the workspace's own Credentials can run. Crons and Deploys run on these. | Work that runs on workspace Credentials, such as the sessions the Cron Agent files, cannot start. | ```bash curl -s "https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/access-status?scope=workspace" \ -H "Authorization: Bearer $KOSUKE_API_KEY" ``` ```json { "data": { "canAccess": true, "reason": null, "activeProvider": "anthropic", "defaultModel": "anthropic:opus__xhigh", "providers": { "anthropic": true, "openai": true, "zai": false, "moonshot": false, "deepseek": false } } } ``` | Field | Meaning | | --- | --- | | `canAccess` | `true` when at least one provider can run. | | `reason` | Why `canAccess` is `false`, as a sentence you can show a person. `null` otherwise. | | `providers` | Whether each of `anthropic`, `openai`, `zai`, `moonshot` and `deepseek` can run. | | `activeProvider` | The provider of the default model when it can run, otherwise the first provider that can. | | `defaultModel` | The model a new session starts on when nobody picks one. | | `providerAvailability` | Each connected provider's `state` now: `available`, `limit_reached` (with `resetAt` when known), `reconnect_required` or `unknown`. A GLM Coding Plan or Kimi Code key is checked with the provider itself: a window at 100% is `limit_reached`, a refused key is `reconnect_required` with a `reason` that says how to fix it, and a key whose usage could not be read is `unknown`, never `available`. Each state clears by itself once the window resets or the key works again, within about 5 minutes. | The response also carries `credentials`, the state of each auth method behind those providers. [Provider credentials](https://kosuke.ai/docs/endpoint-reference/provider-credentials.md) describes that shape. In the CLI, run `kosuke providers access get --scope workspace`. ## Credits and usage Read how much the workspace has spent against its plan's included usage, and how much of that usage is left. On a paid plan this covers the current month of the subscription. On trial and enterprise it covers all usage to date. ```bash curl -s https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/credits \ -H "Authorization: Bearer $KOSUKE_API_KEY" ``` ```json { "data": { "plan": "pro", "limitUsd": 250, "usedUsd": 57.4, "remainingUsd": 192.6, "percentUsed": 0.2296, "isUnlimited": false, "isNearLimit": false, "isOverLimit": false, "periodStart": "2026-09-01T00:00:00.000Z", "periodEnd": "2026-10-01T00:00:00.000Z" } } ``` | Field | Meaning | | --- | --- | | `limitUsd` | The plan's included usage for the current window, in USD. With overage on, the workspace stops at `ceilingUsd` instead. `null` when `isUnlimited` is `true`. | | `usedUsd` | Spent this period, including an estimate for sandboxes still running. | | `remainingUsd` | What is left of `limitUsd`. `null` when unlimited. | | `percentUsed` | `usedUsd` as a share of `limitUsd`, from 0 to 1. | | `isNearLimit` | `true` at 80% of the limit or more. | | `isOverLimit` | `true` when the workspace is blocked on billing, for example because it spent its limit or a payment is past due. Calls that start paid work then answer `402 CREDIT_LIMIT_REACHED`. | | `plan` | `trial`, `starter`, `pro` or `enterprise`. | The response carries more billing fields, such as the overage settings. Plans and what they include are on [Plans and billing](https://kosuke.ai/docs/workspace/plans-and-billing.md). `GET /api/organizations/{workspaceId}/usage` breaks sandbox time down by day and by project. | Query parameter | Meaning | | --- | --- | | `start` | Start of the range, any date string. Its date is the first day read. Defaults to 30 days before `end`. | | `end` | End of the range, not included. Defaults to now. The range can span at most 366 days. | | `tz` | The IANA time zone the days run in, such as `Europe/Rome`. Defaults to your own timezone. | ```bash curl -s "https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/usage?start=2026-09-01&end=2026-09-30&tz=Europe/Rome" \ -H "Authorization: Bearer $KOSUKE_API_KEY" ``` ```json { "data": { "days": [ { "day": "2026-09-01", "hours": { "session": 6.5, "main": 24, "pool": 3, "deploy": 0.4, "orchestrator": 0 }, "priceUsd": { "session": 1.3, "main": 4.8, "pool": 0.6, "deploy": 0.08, "orchestrator": 0 } } ], "totals": { "hours": { "session": 6.5, "main": 24, "pool": 3, "deploy": 0.4, "orchestrator": 0 }, "priceUsd": { "session": 1.3, "main": 4.8, "pool": 0.6, "deploy": 0.08, "orchestrator": 0 } }, "byProject": [{ "projectId": "3f6c1e0a-8b2d-4e57-9a41-0c2f7d9b5e18", "name": "storefront", "hours": 33.9, "priceUsd": 6.78 }] } } ``` Each day runs from midnight to midnight in `tz`. A sandbox's time counts on the day its run ended. Your plan's included usage and billing still count in UTC. Time from sandboxes still running shows in `usedUsd` on the credits route first. `hours` are hours of sandbox time, and `priceUsd` is what that time costs in USD. Both are split by kind of sandbox: | Key | Sandbox | | --- | --- | | `session` | Chat session sandboxes. | | `main` | Each project's main sandbox. | | `pool` | Sandboxes kept warm so new sessions start fast. | | `deploys` | Deploy sandboxes. | | `orchestrator` | Past usage from the retired Slack Bot, shown as Slack Bot (retired). | `byProject` puts the most expensive project first. The response also has `byProjectDaily`, the same days split by project. In the CLI, run `kosuke workspaces credits get ` and `kosuke workspaces usage get --start 2026-09-01`. ## Sandbox limit and stopping sandboxes Your plan caps how many sandboxes run at once. Read the cap and the sessions using it. ```bash curl -s https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/sandbox-limit \ -H "Authorization: Bearer $KOSUKE_API_KEY" ``` ```json { "data": { "maxConcurrentSandboxes": 10, "runningSessions": [ { "sessionId": "b1d6e2f4-7a3c-4c1e-9f0b-2e8d5a6c7b90", "title": "Fix the checkout total", "projectId": "3f6c1e0a-8b2d-4e57-9a41-0c2f7d9b5e18", "projectName": "storefront", "branch": "kosuke/chat-x7k2m9" } ] } } ``` `maxConcurrentSandboxes` is `null` when your plan sets no cap. When the cap is full, starting a Backlog session answers `400`, and a message that has to wake a paused sandbox answers `409 SANDBOX_LIMIT_REACHED`. Pause some sandboxes to make room: | Body field | Meaning | | --- | --- | | `sessionIds` | 1 to 50 chat session ids, all in this workspace. | ```bash curl -s https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/stop-sandboxes \ -H "Authorization: Bearer $KOSUKE_API_KEY" \ --json '{ "sessionIds": ["b1d6e2f4-7a3c-4c1e-9f0b-2e8d5a6c7b90"] }' ``` ```json { "data": { "results": [{ "sessionId": "b1d6e2f4-7a3c-4c1e-9f0b-2e8d5a6c7b90", "stopped": true }] } } ``` Each paused sandbox frees one slot. The session keeps its branch and its conversation. A sandbox that failed to pause comes back with `stopped: false`. In the CLI, run `kosuke workspaces sandbox-limit get ` and `kosuke workspaces sandboxes stop --session-ids '[""]'`. ## Members List the workspace's members and its pending invitations. Pass `includeInvitations=false` to leave the invitations out. ```bash curl -s https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/members \ -H "Authorization: Bearer $KOSUKE_API_KEY" ``` ```json { "data": { "members": [ { "id": "u8Rk2mQ4xT7vB1nP9sL3cW6yD0fH5jZa", "email": "sam@acme.dev", "name": "Sam Rivera", "image": null, "role": "owner", "createdAt": 1756717200000, "subscriptions": { "anthropic": true, "openai": false, "zai": false, "moonshot": false, "deepseek": false }, "providerAccess": { "anthropic": true, "openai": true, "zai": false, "moonshot": false, "deepseek": false }, "defaultModel": "anthropic:opus__xhigh" } ], "membersCount": 1, "invitations": [ { "id": "Qm7tV2cX9pL4wR8nB1kD6sH3yF0gJ5aZ", "email": "kai@acme.dev", "role": "member", "status": "pending", "createdAt": 1759132800000 } ], "invitationsCount": 1 } } ``` `createdAt` is in milliseconds since the epoch. `subscriptions` says which providers the member runs on their own Subscription, and `providerAccess` which providers they can run at all. Inviting, removing and changing roles happen in the web app, under Settings > Workspace > Members. See [Members and roles](https://kosuke.ai/docs/workspace/members-and-roles.md). In the CLI, run `kosuke workspaces members list --no-include-invitations`. ## Plugins List the Plugins the Official Marketplaces offer and whether the workspace has each one on. Pass `provider=anthropic` for Claude Plugins or `provider=openai` for Codex Plugins. ```bash curl -s "https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/plugins?provider=anthropic" \ -H "Authorization: Bearer $KOSUKE_API_KEY" ``` ```json { "data": [ { "id": "code-review@claude-plugins-official", "provider": "anthropic", "name": "code-review", "marketplace": "claude-plugins-official", "description": "Automated code review for pull requests using multiple specialized agents with confidence-based scoring to filter false positives", "category": "productivity", "enabled": false, "lastInstallFailure": null } ] } ``` `components` lists the skills, commands, agents and hooks inside each plugin. `lastInstallFailure` names the latest chat session where the plugin failed to install, with a `message`, or is `null`. To turn a plugin on or off, send its `id` in the path. Owners and admins only. The route answers `204`, and running chat sessions install or remove the plugin at their next turn. | Body field | Meaning | | --- | --- | | `enabled` | `true` to turn the plugin on, `false` to turn it off. | ```bash curl -s -X PATCH "https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/plugins/$PLUGIN_ID" \ -H "Authorization: Bearer $KOSUKE_API_KEY" \ --json '{ "enabled": true }' ``` In the CLI, run `kosuke plugins list --provider anthropic` and `kosuke plugins update --enabled` (or `--no-enabled`). What plugins are and how they reach a session is on [Plugins](https://kosuke.ai/docs/plugins.md). ## Skills List, read, add, change and remove the workspace's Custom Skills. Anyone in the workspace can read them. Only owners and admins can change them. Factory Skills are not listed here. They ship in Sensei's `kosuke` plugin, and every session carries them. `GET /api/organizations/{workspaceId}/skills` lists every Custom Skill by name: ```json { "data": [ { "id": "7c0e5d2a-1f4b-4a8e-b6d3-9e2f1c4a7b58", "name": "release-notes", "description": "Draft release notes from merged pull requests.", "enabled": true, "fileCount": 2 } ] } ``` `GET /api/organizations/{workspaceId}/skills/{skillId}` reads one Custom Skill and adds `files`, every file with its `path` and `content`. ### Add a skill Send every file of the skill. The route answers `201` with the new skill's `id`. | Body field | Meaning | | --- | --- | | `files` | Array of `{ "path", "content" }`. One file must be `SKILL.md`. | | `enabled` | Optional. Defaults to `true`. | ```bash curl -s https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/skills \ -H "Authorization: Bearer $KOSUKE_API_KEY" \ --json '{ "files": [ { "path": "SKILL.md", "content": "---\nname: release-notes\ndescription: Draft release notes from merged pull requests.\n---\n\nList the pull requests merged since the last tag and group them by area." } ] }' ``` ```json { "data": { "id": "7c0e5d2a-1f4b-4a8e-b6d3-9e2f1c4a7b58" } } ``` | Rule | Limit | | --- | --- | | Files | Text only. At most 50 files, 100 KiB each and 1 MiB in all. | | `name` in the `SKILL.md` frontmatter | Lowercase letters and digits in words joined by single hyphens, 1 to 64 characters. No other Custom Skill may hold it. | | `description` | 1 to 1024 characters. | | `argument-hint` | Optional, up to 128 characters. | ### Change or remove a skill `PATCH /api/organizations/{workspaceId}/skills/{skillId}` takes `enabled`, `files` or both, and answers `204`. `files` replaces every file of the skill. `DELETE /api/organizations/{workspaceId}/skills/{skillId}` deletes a Custom Skill and its files, and answers `204`. In the CLI, the commands are `kosuke skills list`, `get`, `create`, `update` and `delete`. For `create`, pass the body with `--body-file skill.json`. The web app side is on [Manage Workspace Skills](https://kosuke.ai/docs/skills/manage-workspace-skills.md). ## Integrations Read which integrations are connected to the workspace. `GET /api/organizations/{workspaceId}/integrations` lists every toolkit the deployment offers, and any the workspace still holds, each with the same fields as the single read below under `data.integrations`. Connecting one is a browser flow, under Settings > Workspace > Integrations. `{toolkit}` is the toolkit's slug, such as `sentry`; a slug the deployment does not offer and the workspace never connected is a 404. Set `TOOLKIT=sentry` for the example. ```bash curl -s https://app.kosuke.ai/api/organizations/$WORKSPACE_ID/integrations/$TOOLKIT \ -H "Authorization: Bearer $KOSUKE_API_KEY" ``` ```json { "data": { "toolkit": "sentry", "name": "Sentry", "offered": true, "configured": true, "status": "connected", "tenant": { "noun": "organization", "key": "acme" }, "scopes": ["org:read", "project:read", "event:read", "event:write"], "authorizedBy": "sam@acme.dev", "authorizedAt": "2026-09-02T10:15:00.000Z", "reconnectReason": null, "needsSelection": false, "cleanupPending": false, "ownAttempt": false, "hasBinding": true } } ``` `tenant` is `null` for a toolkit that binds whatever the admin authorized, and otherwise names what the grant is confined to, with the key bound. `offered` is `false` for a toolkit the deployment no longer lists, which can only be disconnected. `scopes` lists the access the authorization requested, not what the toolkit confirmed it granted. `configured` is `false` when the deployment has integrations switched off. | `status` | Meaning | | --- | --- | | `not_connected` | The toolkit is not connected in this workspace. | | `connecting` | An admin has started connecting the toolkit and has not finished. `ownAttempt` is `true` when that admin is you. `hasBinding` is `true` when a connection is still in place underneath. | | `connected` | Connected and working. | | `temporarily_unavailable` | The toolkit could not be reached just now. The connection is kept; read again later. | | `reconnect_required` | An admin has to connect the toolkit again. `reconnectReason` is `backend_changed` for a workspace connected before Sensei moved Sentry to its current connection service, or whose pinned toolkit version is no longer served, and `account_expired` when the authorization stopped working. | `DELETE /api/organizations/{workspaceId}/integrations/{toolkit}` disconnects the integration. Owners and admins only. It answers `{ "data": { "disconnected": true, "cleanupPending": false } }`, also when nothing was connected. Agents lose access at once either way. `cleanupPending: true` means the stored authorization could not be deleted yet, and Sensei keeps retrying in the background. See [Integrations](https://kosuke.ai/docs/workspace/integrations.md). In the CLI, run `kosuke integrations connections list`, `get` or `remove`. ## Getting-started guide Read which steps of the workspace's getting-started guide are done. ```json { "data": { "projectImported": true, "previewDeployed": true, "sessionStarted": true, "prOpened": false, "prMerged": false, "dismissedAt": null, "previewOpenedAt": "2026-09-03T08:41:10.000Z" } } ``` `PATCH .../getting-started` takes `{ "action": "dismiss" }` to hide the guide, or `{ "action": "preview_opened" }` to record that step. An empty body also dismisses it. In the CLI, run `kosuke workspaces getting-started get ` and `kosuke workspaces getting-started update --action dismiss`. ## Errors | Status | Code | When | | --- | --- | --- | | 400 | `BAD_REQUEST` | The usage range is invalid, a session id is not in this workspace, or the guide `action` is unknown. The timezone is unknown or would break a cron. The sandbox cap is full when you start a Backlog session. | | 400 | `VALIDATION_ERROR` | The body fails the schema, including the skill file and front matter rules. `details` names the fields. | | 403 | `FORBIDDEN` | You are not a member of the workspace, or a member called a route for owners and admins. | | 404 | `NOT_FOUND` | No such skill, or the plugin is not in the Official Marketplace. | | 409 | `SKILL_NAME_TAKEN` | Another Workspace Skill already has that name. | The full list is in [Responses and errors](https://kosuke.ai/docs/api/errors.md). ## Next steps - Store the Credentials the workspace runs on with [Provider credentials](https://kosuke.ai/docs/endpoint-reference/provider-credentials.md). - Import a repository into the workspace with [Projects](https://kosuke.ai/docs/endpoint-reference/projects.md).