Skip to main content
The Workspace API manages your organization’s sandbox and production apps from your backend. It uses the same application services as the Console, with an organization API key instead of a Console login.
The v2 Workspace API is available to organizations with an Enterprise subscription. Other organizations get 403 SUBSCRIPTION_REQUIRED on every request. Contact support@hopae.com to enable it.

​
Authentication and base URL

Use Authorization: Bearer sk_workspace_... and the base https://api.hopae.com/connect/v2. The key identifies an organization; the app ID determines the application environment. App Secret Basic auth is reserved for verification runtime calls.
The routes are /connect/v2/apps and /connect/v2/apps/{appId}/.... There is no /workspace or environment path segment. A request without a Bearer token returns 400 VALIDATION_MISSING_PARAMETER, and a key that is not a valid Workspace API key returns 401 AUTH_INVALID_CREDENTIALS. An app of another organization returns 403 AUTH_FORBIDDEN; an unknown app returns 404 RESOURCE_NOT_FOUND. Error responses carry error.code, error.message, an optional error.details, and request_id. Switch on error.code, and quote request_id when you contact support.

​
Operations

Production configuration writes, such as redirect URIs, update Live immediately and are kept in Version History. Sandbox configuration is overwritten in place. Workflows are managed in the Console.

​
Request behavior

Requests with bodies use Content-Type: application/json, up to 1 MB; a larger Content-Length returns 400 VALIDATION_INVALID_PARAMETER. Create App, Activate Connection, and Instant Activate support Idempotency-Key. Keys are scoped to your organization and remembered for 24 hours: a repeat with the same key and body returns the stored response with Idempotency-Replayed: true, a different body returns 409 IDEMPOTENCY_KEY_CONFLICT, and a repeat while the first request is still running returns 409 IDEMPOTENCY_REQUEST_IN_PROGRESS. App creation also returns a Location header that points to Get App. Lists are not paginated: List Apps and List App Connections each return one array.

​
Setup sequence

  1. Create an app, choosing its environment explicitly. A sandbox app created with mode: "quickstart", or a production app created with workflow, starts with a default workflow.
  2. Copy its App Secret from the Console under Developers → API Settings and keep it on your backend.
  3. Replace its redirect URIs if you use the hosted OIDC flow.
  4. Inspect connections and activate the ones you need. On a sandbox app, finish pending registration submissions with Instant Activate.
  5. Use the app credentials with Create Verification, or run the hosted OIDC flow.