> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentlinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Human account access

> Workspace creation, invitation acceptance and credential administration use human authentication.

Workspace creation, invitation acceptance and credential administration require a human session. These flows have HTTP endpoints; they are outside the shared agent command catalog. Use the authenticated app for interactive account work.

| Operation             | Request                                | Result                                                             |
| --------------------- | -------------------------------------- | ------------------------------------------------------------------ |
| List workspaces       | GET /v1/workspaces                     | items with id, name and role for current human memberships         |
| Create workspace      | POST /v1/workspaces with name          | HTTP 201 workspace bootstrap result                                |
| Accept invitation     | POST /v1/invitations/accept with token | HTTP 201 accepted membership; verified email must match invitation |
| Read access records   | GET /v1/access                         | keys and grants arrays, up to 100 each, newest first               |
| Create API credential | POST /v1/access/keys                   | HTTP 201 credential response below                                 |
| Revoke credential     | DELETE /v1/access/keys/ID              | id and revoked:true                                                |
| Revoke agent grant    | DELETE /v1/access/grants/ID            | id and revoked:true                                                |

Access listing and revocation require owner/admin membership. Creation validates requested scopes against the human's current permission ceiling and every selected project. It cannot grant access the creator lacks.

## API credential input

```json theme={null}
{"name":"Repository monitor","scopes":["projects:read","watches:read","events:read"],"projectIds":["prj_example"],"expiresInDays":30}
```

`name` is a nonempty string of up to 100 characters. `scopes` must contain supported scopes within current access. `projectIds` is null for unrestricted project access or an array of 1 to 100 project IDs in this workspace. Project-restricted access cannot request `projects:write`. `expiresInDays` is an integer from 1 to 90, default 30.

The response contains `id`, `token`, `name`, `scopes`, `projectIds` and `expires_at`. The full token is returned once. Access listings expose metadata such as prefix, scopes\_json, project\_ids\_json, created\_at, expires\_at and revoked\_at; they do not recover a token.

For normal cloud work, use the [HTTP command interface](/reference/http/conventions). [Members](/reference/commands/list_members), [invitations](/reference/commands/list_invitations) and [access changes](/reference/commands/set_member_access) have shared command pages. Creating an invitation does not authorize sending an email automatically.

<Note>Reference follows the current development CLI and HTTP contracts. Hosted availability depends on the selected environment. See [capability status](/capability-status).</Note>