Summary

• Add canonical /workspaces/{workspace_id}/... aliases for workspace-scoped public API routes while keeping the legacy flat routes registered as hidden compatibility aliases.
• Move service account API key auth to Authorization: Bearer ... and keep it separate from executor bearer-token auth.
• Add route-shape regression tests that verify canonical and legacy aliases share handlers and use the path-or-query workspace RoleACL path.
• Regenerate the frontend API client for the new OpenAPI route shape.

API surface changes

Workspace-scoped public routes now expose the workspace in the path. The old flat routes still work at runtime, but they are hidden from OpenAPI so generated clients move to the canonical workspace-scoped shape.

Newly documented workspace aliases

This PR moves the public OpenAPI shape for these route prefixes under /workspaces/{workspace_id}:

/workspaces/{workspace_id}/actions
/workspaces/{workspace_id}/agent/channels/tokens
/workspaces/{workspace_id}/agent/presets
/workspaces/{workspace_id}/agent/sessions
/workspaces/{workspace_id}/agent/skills
/workspaces/{workspace_id}/agent/skills:upload
/workspaces/{workspace_id}/agent/workspace/providers/status
/workspaces/{workspace_id}/approvals
/workspaces/{workspace_id}/case-dropdowns
/workspaces/{workspace_id}/case-durations
/workspaces/{workspace_id}/case-fields
/workspaces/{workspace_id}/case-tags
/workspaces/{workspace_id}/cases
/workspaces/{workspace_id}/editor
/workspaces/{workspace_id}/folders
/workspaces/{workspace_id}/inbox
/workspaces/{workspace_id}/integrations
/workspaces/{workspace_id}/mcp-integrations
/workspaces/{workspace_id}/providers
/workspaces/{workspace_id}/schedules
/workspaces/{workspace_id}/secrets
/workspaces/{workspace_id}/tables
/workspaces/{workspace_id}/tags
/workspaces/{workspace_id}/variables
/workspaces/{workspace_id}/workflow-executions
/workspaces/{workspace_id}/workflows

The EE approval route is included in this migration: /approvals/{session_id} is now documented as /workspaces/{workspace_id}/approvals/{session_id}.

Existing workspace routes

These routes were already workspace-scoped before this PR and remain in OpenAPI as-is:

/workspaces
/workspaces/search
/workspaces/{workspace_id}
/workspaces/{workspace_id}/agent-models
/workspaces/{workspace_id}/invitations
/workspaces/{workspace_id}/members
/workspaces/{workspace_id}/memberships
/workspaces/{workspace_id}/service-accounts

Before and after examples

Workflow execution ID ergonomics

The old direct execution lookup took the full workflow execution ID as one path parameter:

GET /workflow-executions/{execution_id}

For canonical execution IDs like wf_abc/exec_def, clients had to treat the slash as part of the path parameter, so generated clients and manual callers needed to URL-encode the full ID, for example:

GET /workflow-executions/wf_abc%2Fexec_def

This PR adds a workflow-scoped read route that splits the workflow ID and execution suffix into separate path parameters:

GET /workspaces/{workspace_id}/workflows/{workflow_id}/executions/{execution_id}

Example:

GET /workspaces/ws_123/workflows/wf_abc/executions/exec_def

That route reconstructs the Temporal workflow execution ID as wf_abc/exec_def server-side, so clients no longer need to pass the slash-bearing full execution ID for the common read-by-workflow case. Direct execution routes still exist under the canonical workspace prefix for callers that already have the full execution ID.

Routes intentionally left flat

Some routes are not workspace-prefixed because they are callbacks, public entrypoints, organization-level APIs, platform/admin APIs, or internal APIs. Notable examples:

• Callback and public entrypoints: /integrations/callback, /agent/channels/{channel_type}/{token}, /agent/channels/slack/oauth/callback, /webhooks/{workflow_id}/{secret}
• Organization-level routes: /organization/..., /organization/service-accounts/..., /organization/secrets/..., /organization/vcs/...
• Platform/ops routes: /admin/..., /settings/..., /registry/..., /feature-flags, /health, /ready
• EE platform routes: /rbac/..., /watchtower/monitor/...
• Internal routes: /internal/...

Validation

• uv run ruff check ...
• uv run ruff format --check ...
• uv run basedpyright ...
• TRACECAT__SERVICE_KEY=test-service-key TRACECAT__SIGNING_SECRET=test-signing-secret uv run pytest tests/unit/test_role_acl.py tests/unit/api
• pnpm -C frontend check
• pnpm -C frontend run typecheck