Verify existing REST access or provision a prospect workspace with a separate administrative credential. Creation uses the normal workspace lifecycle and needs no browser session.
2 endpoints
GET /external/v1/auth/contextRead the exact workspace, credential ID, scopes and expiry selected by this REST key. Works in an empty workspace without creating probe records. Returns no secret or hash. No additional resource scope is required.
Workspace identity and credential metadata, without the secret.
The key is invalid, expired or revoked.
POST /external/v1/workspacesCreate a real prospect evaluation workspace with its normal Owner, default team, trial plan and full content API key. Requires a separate provisioning-only key with workspaces:provision, issued by an eligible Zentrik administrator in Settings > API Keys. Normal content keys cannot call this route. The content key has its own expiry and remains usable after the provisioning credential expires or is revoked. Repeating the same owner/reference reuses the workspace, preserves its name and plan, and replaces only the last key issued by this endpoint. Save the one-time secret and use auth/context for normal resumes; repeated POSTs rotate that key. Different references run independently.
Stable prospect reference, unique per owning user and environment. 1-120 lowercase letters, digits, dots, underscores, colons or hyphens; first character is a letter or digit. Never change it to retry.
Initial workspace name, 1-80 characters without control characters. Ignored on retry; existing names are preserved.
Normal workspace key name, 1-80 characters. Default: a name like `Zentrik Setup [agent-912]`, using the server’s UTC month and day.
Future workspace key expiry. Default: 90 days from this request. Does not extend the existing 14-day workspace trial.
For explicit replacement: require this reference to already identify this workspace. Refuses a different owner or destination without creating anything.
reference, workspace {id,name}, key {id,name,keyPrefix,scopes,expiresAt,secret}, plan {tier,status,subscriptionEnd}, and replayed. Store secret privately; response is private, no-store.
Invalid reference, name, future expiry or unexpected field.
The provisioning key is invalid, expired or revoked.
Missing provisioning-only scope, inactive/non-administrator creator, or lost Owner membership.
Expected workspace does not match, or the destination is being deleted.
This reference previously created a workspace which was deleted. It will not be recreated.
/external/v1/workspaces{
"reference": "calendly",
"name": "Calendly Sandbox",
"keyName": "Zentrik Setup [agent-912]"
}