> ## Documentation Index > Fetch the complete documentation index at: https://docs.prisme.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get Org Workspace Privileges > Get workspace privileges for an organization. Requires the `orgs:workspace-privileges:read` permission, held by Owner and SuperAdmin by default. `workspaceIdOrSlug` accepts either a raw workspace ID, or `slug:` for slug-based lookup. Bare IDs work even when the underlying workspace has been deleted, so orphan rows remain inspectable. Authorization is enforced before workspace resolution, so non-authorized callers always get 403 (never 404). ## OpenAPI ````yaml /api-reference/swagger.yml get /v2/orgs/{orgSlug}/workspaces/{workspaceIdOrSlug}/privileges openapi: 3.0.0 info: version: 1.0.0 title: Prisme.ai APIs description: Prisme.ai APIs specifications termsOfService: https://www.prisme.ai/mentions-legales contact: name: Prisme.ai Support Team email: support@prisme.ai url: https://www.prisme.ai license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0.html servers: - url: https://api.studio.prisme.ai description: Prisme.ai Cloud - url: https://{customDomain} description: Self-hosted Prisme.ai instance variables: customDomain: default: api.your-prisme-instance.com description: API hostname of your self-hosted Prisme.ai deployment - url: http://localhost:3001 description: Local development security: - BearerAuth: [] - OrgApiKeyAuth: [] - BearerAuth: [] OrgApiKeyAuth: [] tags: - name: API Gateway description: >- Authentication, session management, SSO providers, and user profile endpoints. - name: Prisme.ai Workspaces description: >- CRUD operations for workspaces and their resources (pages, apps, automations, imports, variables). - name: Prisme.ai Runtime description: Execute workspace automations and manage their runtime lifecycle. - name: Prisme.ai Events description: Event ingestion, delivery, and subscription filtering across the platform. - name: Organizations description: >- Manage organizations, members, roles, invites, groups, and org-level service accounts. - name: Subscriptions description: >- Manage organization subscription plans and tier assignments (SuperAdmin only). - name: Secrets description: Read and patch encrypted key-value secrets scoped to a workspace. - name: ApiKeys description: Create, list, rotate, and validate workspace-scoped API keys. - name: Permissions description: >- Share or unshare resources (workspaces, pages, …) with users via roles or fine-grained rules. - name: Monitoring description: Platform readiness checks across services (SuperAdmin only). - name: AuthProviders - name: OIDC description: >- Endpoints of the embedded OpenID Connect provider, mounted under /oidc. The protocol endpoints follow OpenID Connect Core / OAuth 2.0 and are best resolved from GET /oidc/.well-known/openid-configuration; the /oidc/interaction/* routes are Prisme.ai-specific and covered by no standard. paths: /v2/orgs/{orgSlug}/workspaces/{workspaceIdOrSlug}/privileges: get: tags: - Organizations summary: Get Org Workspace Privileges description: | Get workspace privileges for an organization. Requires the `orgs:workspace-privileges:read` permission, held by Owner and SuperAdmin by default. `workspaceIdOrSlug` accepts either a raw workspace ID, or `slug:` for slug-based lookup. Bare IDs work even when the underlying workspace has been deleted, so orphan rows remain inspectable. Authorization is enforced before workspace resolution, so non-authorized callers always get 403 (never 404). operationId: getOrgWorkspacePrivileges parameters: - name: orgSlug in: path required: true schema: type: string - name: workspaceIdOrSlug in: path required: true schema: type: string description: Workspace ID, or `slug:` for slug addressing. responses: '200': description: Workspace privileges content: application/json: schema: $ref: '#/components/schemas/OrgWorkspacePrivileges' '401': description: AuthenticationError content: application/json: schema: $ref: '#/components/schemas/AuthenticationError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ObjectNotFoundError' components: schemas: OrgWorkspacePrivileges: type: object description: Org-specific workspace privileges configuration required: - orgSlug - workspaceId - privileges properties: id: type: string orgSlug: type: string description: Organization that owns these privilege settings workspaceId: type: string description: >- Canonical workspace ID. The authoritative key — immutable across slug renames. workspaceSlug: type: string description: > Workspace slug captured at write time and refreshed on each upsert. Denormalized — never used as a lookup key. May be stale relative to the workspace's current slug between writes; treat as advisory for display only. privileges: $ref: '#/components/schemas/WorkspacePrivilegesConfig' createdBy: type: string updatedBy: type: string createdAt: type: string updatedAt: type: string AuthenticationError: type: object properties: error: type: string example: AuthenticationError message: type: string example: Unauthenticated ObjectNotFoundError: type: object properties: error: type: string example: ObjectNotFound message: type: string WorkspacePrivilegesConfig: type: object description: Workspace privileges configuration for privileged module access properties: accessManager: $ref: '#/components/schemas/AccessManagerPrivileges' AccessManagerPrivileges: type: object additionalProperties: false description: Configuration for access-manager module privileges properties: enabled: type: boolean description: Whether access-manager module is enabled for this workspace serviceAccounts: type: object additionalProperties: false description: >- Service account minting gates. Omit if the workspace does not use serviceAccount instructions. properties: defaultRoleSlug: type: string description: Default role slug for service accounts created by this workspace allowedRoleSlugs: type: array items: type: string description: List of allowed role slugs for service accounts apiKeys: type: object additionalProperties: false description: >- API key minting gates. Omit if the workspace does not use apiKey instructions. properties: allowedPermissions: type: array items: type: string description: >- Fully-qualified permission patterns the workspace may attach to API keys. Trailing `*` matches any suffix. allowedScopes: type: array items: type: string description: >- Fully-qualified scope patterns the workspace may attach to API keys. Trailing `*` matches any suffix. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT OrgApiKeyAuth: type: apiKey in: header name: x-prismeai-api-key ````