NQD API workspaces and scopes
Select one verified workspace for each workspace-scoped request.
GET /v1/workspaces lists the account’s memberships. Identity-scoped calls omit Workspace-Id. Every workspace-scoped request, including GET and DELETE, sends one Workspace-Id header. The header selects a scope; it grants no access.
Missing, malformed, duplicate, or comma-joined selectors return 400. A revoked membership returns 403. Resource IDs and filters stay inside the selected workspace.
The /v1 path selects the API contract. It is the only version selector. API URLs do not repeat the workspace as a path segment; Workspace-Id supplies that scope.
Resource bodies contain authored fields and relationships. Do not repeat the selected workspace in a body: Workspace-Id is the scope for the request. No request chooses a first workspace automatically.
For ordinary workspace-owned records, a null clientId means the current Workspace. Contacts can carry nullable clientId and vendorId relationships: both null means the Workspace owns the contact, while either relationship identifies its associated party. When both are supplied, they must resolve to the same party. Do not manufacture a Client to represent the Workspace. Payout Contacts identify recipients independently of a Project’s Client.
Caches should include principal, workspace, version, resource, and query. Discard cached data when scope changes.