|Manuals

Workspace REST API Overview

The Thinfinity® Workspace REST API exposes programmatic control over an operating deployment, so IT teams can build their own administrative automation on top of Workspace: provisioning access, maintaining Access Profiles, driving operational actions, and feeding monitoring pipelines. The complete endpoint reference — paths, verbs, request and response schemas, and the authentication guide — lives on the external docs site; this article summarizes what the API does and does not cover.

What the API covers

Access Profile and label management. Full CRUD on Access Profiles, including per-profile credential management, bulk update and bulk removal, import and export, and commit or rollback of staged edits. Labels and label-based ACLs are manageable the same way. Permission groups let scripts package a profile set behind a single assignable permission.

Identity integration and permissions. Directory-services configuration (connect to Active Directory or LDAP, search, test, enable or disable), authentication-method and two-factor configuration, passkey registration and removal, and the full permissions surface (schemes, groups, per-profile grants). Combined, these let an external identity-management system drive a user’s Workspace access without manual admin steps — Workspace reads the user from the directory, and the API grants or revokes resource access per directory state. Workspace does not create or delete user accounts through the API; user accounts live in the identity provider.

Operational control. Session and connection termination, broker drain mode for maintenance, remote-command execution against broker processes, and license usage readout.

Monitoring and telemetry export. Read-only broker and process info, diagnostic snapshots, and OpenTelemetry (OTLP) YAML configuration. For continuous observability, Workspace is designed to export telemetry to an OTLP-compatible backend; the REST API itself is for configuration and point-in-time state, not for the metric stream. The configuration/notifications endpoint configures the SMTP server used for the broker’s built-in notification emails — it is a transport configuration, not an alert-rules or webhook-subscription surface.

Deployment configuration. Each configuration/* section — authentication methods, brokers and gateways, folders, notifications, permissions, protection, services, VirtualUI, and more — exposes the same areas the Thinfinity Configuration Manager exposes in its UI, so a scripted deployment can produce the same configuration an operator would hand-build.

What the API does not cover

Two capabilities often expected in an “enterprise automation” API are intentionally absent and must be handled outside Workspace:

  • Event-driven alerts and webhooks. The API has no endpoint to register for push notifications on Workspace events. Admins who need alerting on specific conditions (resource outage, authentication failure, license threshold, and the like) build it by polling the monitoring endpoints or by consuming the OTLP metric stream from an observability backend that supports alerting (Prometheus, Grafana, Datadog, and others).
  • Direct DevOps and ITSM platform hooks. Workspace does not open tickets, file incidents, or push notifications to external DevOps or ITSM tools directly. The same polling or OTLP integration pattern applies: route Workspace telemetry into an observability or SIEM backend that already integrates with the ITSM platform.