The caller's workspace
What the dashboard shows a signed-in human: their workspace, or a 404 whose code routes them to onboarding.
Session-only. An API key is refused with 401 — a key already proves a workspace exists.
Authorizations
A dashboard session — the short-lived JWT a signed-in human holds at the dashboard, sent on the same Authorization: Bearer header. Dispatched by shape: a session token is a JWT, an API key starts with ck_. Sessions cannot be created through this API, and operations that list only this scheme refuse API keys with 401.
Response
The workspace this account is a member of.
The caller's workspace, as the dashboard renders it. Tenancy comes from membership — never from anything the request claims.