Create a new workspace
Greenfield-creates a brand-new tenant owned by the caller and switches the
session into it - the authenticated, in-product counterpart to the public
magic-link /v1/auth/signup funnel. Shares the exact same atomic provisioning
(signup::provision_email_tenant), so the new workspace gets the identical
onboarding flow; the only differences are that the owner is taken from the
caller’s verified session email (no re-entry, no magic-link round-trip) and
the session cookie is re-minted for the new tenant on the way out.
Still invite-gated: an invite_code is required and consumed single-use, so
an authenticated member can’t mint workspaces freely. Web-session only - a
PAT / OAuth token is pinned to one workspace and can’t create another.
Idempotency: the single-use invite row is the HARD guard (no double-create
even under concurrency or a cache outage). An optional Idempotency-Key
header adds soft lost-response replay - a retry with the same key returns the
already-created workspace instead of a spurious “invite already used”.
Authorizations
Browser session cookie set by sign-in. Web SPA only; not for PAT/OAuth integrators.
Body
Invite code (inv-…). Required and consumed single-use - creating a
workspace is invite-gated even for an already-authenticated member, so a
signed-in user can't mint workspaces without an invite to spend.
Display name for the new workspace; the URL slug derives from it.
Optional company website / domain; seeds the brand-style crawl. Falls back to the caller's email domain (unless free-mail) when omitted.
Response
Workspace created; session re-scoped to it (fresh cookie set)