> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agents.labs.bandwidth.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspaces and permissions

> Choose the workspace for an API request and understand how your current role limits access.

## Find the workspace ID

Select your workspace in Agent Builder, then open **API & Developers → REST API**. Copy the displayed **Workspace ID**. This positive integer is the local workspace/group identifier used by `X-VOAI-ORGANIZATION-ID`; it is not a tenant UUID, agent ID, or agent UUID.

## API-key requests

Send your key and workspace ID together. The same key can be used with another workspace ID only when its owner is currently a member of that workspace.

```bash theme={null}
curl --fail-with-body 'https://agents.labs.bandwidth.com/api/v1/workflow/fetch' \
  -H "X-BW-LABS-AGENTS-API-KEY: ${LABS_AUTH_API_KEY}" \
  -H "X-VOAI-ORGANIZATION-ID: ${VOAI_ORGANIZATION_ID}"
```

A missing or invalid workspace ID returns `400`. A workspace the owner cannot access returns `403`. Resource IDs must also belong to the requested workspace. A valid empty list means no matching resources were returned; it does not by itself mean authentication failed.

## Bearer and MCP requests

REST bearer requests and MCP connections use the account's selected workspace. MCP's `switch_workspace` changes that selection across clients. It does not change the workspace header your REST integration sends with an API key. See [MCP workspace selection](https://docs.agents.labs.bandwidth.com/mcp/workspaces.md).

## Roles

| Role | Typical access |
| - | - |
| Viewer | Read workspace resources |
| Editor | Read and create or edit supported resources |
| Admin | Configure workspace resources and perform protected management operations |
| Owner | Admin access and ownership-level operations such as changing member roles |

The endpoint's authorization requirements take precedence over this summary. For example, a read-like export can require Editor access, and a write can have additional resource or provider conditions. The separate Labs `super_user` role is required for some bearer-only operations and is not granted by workspace ownership.

Keys follow current permissions. Removing membership or changing a role changes what subsequent requests can do. See [roles and permissions](https://docs.agents.labs.bandwidth.com/core-concepts/roles-and-permissions.md) and [authentication](https://docs.agents.labs.bandwidth.com/api-reference/authentication.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.