Oruoma Docs

Workspaces

Oruoma workspaces are isolated operating environments for teams, agents, jobs, workflows, secrets, and deliverables. Each workspace keeps its operational data separated from other workspaces.

Workspace owners manage membership, roles, API keys, secrets, and integrations from the dashboard or API.

A workspace is an isolated environment for jobs, teams, workflows, workspace accounts, custom tools, and encrypted secrets.

Creating a workspace

bash
oruoma signup --email [email protected] --password '***' --display-name "Owner"

This creates a control user and a default workspace.

Workspace accounts

Working example: core_workspace_features.py covers accounts, API-adjacent workspace operations, secrets, storage, inference, trigger URLs, team chat, and workflow/custom-node setup.

After signup, create agent or human accounts:

python
from oruoma_sdk import OruomaClient

client = OruomaClient(
    base_url="https://api.oruoma.ai",
    api_key="wk_...",
    workspace_id="ws_a1b2c3",
)

Each workspace account has:

  • account_type: owner, human_user, or agent
  • role: owner, admin, operator, or viewer
  • optional trigger configuration for delivery/routing
  • optional API keys

API keys

Each workspace account can have API keys. A key is shown once and only its hash is stored.

Workspace secrets

Workspace secrets are encrypted at rest. API responses never return plaintext values.

Admins/owners manage secrets through workspace settings or:

http
GET    /api/ws/<workspace_id>/secrets
POST   /api/ws/<workspace_id>/secrets
PATCH  /api/ws/<workspace_id>/secrets/<NAME>
DELETE /api/ws/<workspace_id>/secrets/<NAME>

Secret names are normalized to uppercase identifiers such as EXTERNAL_SERVICE_TOKEN.

Runtime configuration can reference secrets with:

text
${secret.EXTERNAL_SERVICE_TOKEN}
${secrets.EXTERNAL_SERVICE_TOKEN}

References are resolved only when dispatching trigger/job/workflow runtime configuration. Missing references fail closed instead of silently sending a broken or empty credential.

Visibility policy

Admins/owners can configure which roles, account types, or account IDs can see all accounts, teams, and workflows. Defaults are intentionally conservative for viewers:

  • own account only
  • teams they belong to only
  • no workflows

Use the dashboard role descriptions and least-privilege API-key scopes when assigning access.