Owners/Admins request a fresh provider-owned settings URL for one
active Workspace installation. The provider call occurs outside the
database transaction. The response contains only the validated URL and
a bounded, display-safe snapshot of current repository selection and
granted permission levels; it never exposes credentials or raw provider
metadata. Providers without a management surface return
provider_capability_unavailable.
Path Parameters
installation_idRequired
string <uuid>
Example0198ac5e-f9b7-7000-8000-000000000001
Header Parameters
X-CSRF-TokenRequired
string·min 43·max 43
Session-bound CSRF token. It must exactly match the
__Host-assign_csrf cookie sent with the request.
Responses
installation_idRequired
string <uuid>
Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
Example0198ac5e-f9b7-7000-8000-000000000001
management_urlRequired
string <uri>·max 2048
Provider-owned settings URL validated against the configured provider origin.
repository_selectionRequired
string
Values
allselectedunknown
granted_permissionsRequired
string[]·max 100
fetched_atRequired
string <date-time>
RFC 3339 timestamp in UTC.
Example2026-08-15T12:00:00Z
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
errorRequired
object
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
errorRequired
object
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
errorRequired
object
Retry-After
integer·min 0
Delay in seconds before retrying, when an expected maintenance end is known.
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
