Skip to content
DocumentationAPI ReferenceChangelog
API ReferenceTalon Studio v1.0.2-beta

Workspaces

List the workspaces a token can reach, and read a single workspace.

List workspaces

GET/api/v1/workspacesworkspaces:read

Lists the workspaces the token can reach. An org service token lists every workspace in the org; a personal org token is filtered to the workspaces its owner can access — direct membership, team membership, or an org-admin role, which sees them all; a workspace-bound token lists only its own.

Response
idstring (UUID)
namestring
descriptionstring · nullable
siemTargetstring
The workspace's primary SIEM — one of splunk, sentinel, elastic, chronicle.
detectionCountinteger
sourcetypeCountinteger
createdAtstring (ISO 8601)
Returned as { data: [...] }, newest-created first. There are no filter or sort parameters.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/workspaces"
Response
{
  "data": [
    {
      "id": "d41f…",
      "name": "Corp SecOps",
      "description": null,
      "siemTarget": "splunk",
      "detectionCount": 130,
      "sourcetypeCount": 42,
      "createdAt": "2026-05-02T09:14:00.000Z"
    }
  ]
}

Get workspace

GET/api/v1/workspaces/{id}workspaces:read

Fetch one workspace by id. A workspace-bound token can only read its own workspace — asking for any other id returns 403. Org tokens get a uniform 404 both for an id that doesn't exist in the org and for a real workspace the token's owner can't access, so a 404 never confirms whether the workspace exists.

Path parameters
idstring (UUID)required
Response
idstring (UUID)
namestring
descriptionstring · nullable
siemTargetstring
The workspace's primary SIEM — one of splunk, sentinel, elastic, chronicle.
siemTargetsstring[]
Every SIEM the workspace deploys to, primary first — element 0 always equals siemTarget.
requiresChangeRequestsboolean
Whether edits must go through a change request.
detectionCountinteger
sourcetypeCountinteger
createdAtstring (ISO 8601)
updatedAtstring (ISO 8601)
Returned as { data: { … } }.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/workspaces/{id}"
Response
{
  "data": {
    "id": "d41f…",
    "name": "Corp SecOps",
    "description": null,
    "siemTarget": "splunk",
    "siemTargets": ["splunk"],
    "requiresChangeRequests": true,
    "detectionCount": 130,
    "sourcetypeCount": 42,
    "createdAt": "2026-05-02T09:14:00.000Z",
    "updatedAt": "2026-09-20T16:40:12.000Z"
  }
}