`GET /api/workspaces/{id}/available-runners` — the org runners AVAILABLE to this workspace (the org's runners whose grant allows it), a read-only inventory for a WORKSPACE admin who need not be an org admin. Gated by `authorize_workspace (ManageMembers)` (workspace owner/admin). No token material; slim DTO.

GET

/api/workspaces/{id}/available-runners

curl --request GET \
  --url https://example.com/api/workspaces/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/available-runners

Parameters

Path Parameters

id

required

string format: uuid

Workspace ID

Responses

200

Runners available to the workspace (no token material)

Media typeapplication/json

Array<object>

A runner AVAILABLE to one workspace (#626) — the read-only inventory a WORKSPACE admin (who need not be an org admin) sees: which of the org’s runners can serve this workspace, with their health/load. Slimmer than OrgRunnerInfo — it omits the grant internals (the org-wide workspace scope, provenance, labels) a workspace admin has no need to see; trust class is kept (it explains “serves any workspace” vs “scoped”).

object

capabilities

required

class

required

trusted (serves any workspace) | edge (scoped to allowed workspaces).

string

id

required

string format: uuid

in_flight

required

Open (‘assigned’/‘claimed’/‘running’) assignments this runner holds.

integer format: int64

last_heartbeat_at

string | null format: date-time

max_parallel

integer | null format: int64

name

required

string

stale

required

boolean

status

required

string

Example^generated

[
  {
    "capabilities": "example",
    "class": "example",
    "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "in_flight": 1,
    "last_heartbeat_at": "2026-04-15T12:00:00Z",
    "max_parallel": 1,
    "name": "example",
    "stale": true,
    "status": "example"
  }
]

401

Authentication required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object

code

required

Machine-readable, stable error code.

string

Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error

details

One of:

null

null

object

Present only on a quota-exceeded 403 — the inline upgrade-CTA payload.

object

key

required

The entitlement feature key that was hit, e.g. apps.max_count.

string

limit

required

The plan’s limit for this key.

integer format: int64

upgrade_url

required

Where to send the user to upgrade.

string

used

required

Current usage (count or bytes, per the key).

integer format: int64

error

required

Human-readable message (the server’s English text; the client may localize by code).

string

Example

{
  "code": "not_found"
}

403

Workspace admin required

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object

code

required

Machine-readable, stable error code.

string

Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error

details

One of:

null

null

object

Present only on a quota-exceeded 403 — the inline upgrade-CTA payload.

object

key

required

The entitlement feature key that was hit, e.g. apps.max_count.

string

limit

required

The plan’s limit for this key.

integer format: int64

upgrade_url

required

Where to send the user to upgrade.

string

used

required

Current usage (count or bytes, per the key).

integer format: int64

error

required

Human-readable message (the server’s English text; the client may localize by code).

string

Example

{
  "code": "not_found"
}

500

Structured server error

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object

code

required

Machine-readable, stable error code.

string

Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error

details

One of:

null

null

object

Present only on a quota-exceeded 403 — the inline upgrade-CTA payload.

object

key

required

The entitlement feature key that was hit, e.g. apps.max_count.

string

limit

required

The plan’s limit for this key.

integer format: int64

upgrade_url

required

Where to send the user to upgrade.

string

used

required

Current usage (count or bytes, per the key).

integer format: int64

error

required

Human-readable message (the server’s English text; the client may localize by code).

string

Example

{
  "code": "not_found"
}