sessions module route (requires sessions:workspace:admin)

POST

/v1/m/sessions/workspaces

curl --request POST \
  --url https://example.com/v1/m/sessions/workspaces \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "allow_subpaths": [ "example" ], "container_target": "example", "dlp_mode": "", "max_read_bytes": 1, "mount_mode": "", "name": "example", "read_only_folders": [ "example" ], "root_path": "example" }'

• this engine

Creates one session workspace from the posted parameters, and answers 503 when the workspace registry is not available.

Authorizations

• bearerAuth
• browserSession

Parameters

Header Parameters

X-Olivares-Tenant

string format: uuid

Target tenant id; required when the principal can act in more than one tenant.

Request Body ^required

Media type application/json

object

allow_subpaths

Any of:

Array

Relative, NUL-free paths that cannot escape the workspace root.

Array

null

null

container_target

Any of:

string

Must be absolute after trimming; empty/null selects the default container target.

string

null

null

dlp_mode

Any of:

string

Empty/null defaults to off.

string

Allowed values: "" label deny off

null

null

max_read_bytes

Any of:

integer

integer format: int64

null

null

mount_mode

Any of:

string

Empty/null defaults to rw. write_no_delete is read-write without the right to remove a name: a native session creates and changes files in the folder (existing files can still be overwritten or emptied) and cannot unlink, rmdir, rename or move one out, and the file API refuses delete and move. The kernel enforces it (Linux Landlock), so a session in such a folder does not start on a host that cannot confine. In a folder that is a Git repository, .git stays fully writable so the agent’s own git works (it renames a lock file over its index), which also lets the session empty .git and destroy the repository’s history; the working files stay protected. A tool that replaces a file by removing or renaming it (sed -i, an atomic-save formatter) is refused and can leave its temporary file. The session’s Git panel acts for the person and is not restricted.

string

Allowed values: "" rw ro write_no_delete

null

null

name

Any of:

string

Trimmed workspace display name.

string

null

null

read_only_folders

Any of:

Array<string>

Additional read-only host folders for native sessions. Read-only folders protect file content and directory entries (no write, truncate, create, remove or rename); permissions, ownership, extended attributes and timestamps follow the host’s normal permissions. Must be absolute, existing directories outside protected engine folders. The server stores canonical paths. Omitted on create or an empty array grants no extra access.

Array<string>

null

null

root_path

required

After trimming, must be an absolute, existing directory; the server stores its canonical real path.

string

Responses

200

OK

Media type application/json

object

Example ^generated

{}

400

Bad request

Media type application/json

object

Example ^generated

{}

401

Unauthenticated

Media type application/json

object

Example ^generated

{}

403

Forbidden

Media type application/json

object

Example ^generated

{}

404

Not found

Media type application/json

object

Example ^generated

{}

409

Conflict / setup required

Media type application/json

object

Example ^generated

{}

429

Rate limited

Media type application/json

object

Example ^generated

{}