> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Start a workspace run > Bearer PAT authentication; RBAC permission `workspaces.use` for the caller's own workspace, `workspaces.manage` for another member's. Starts a command in the workspace against the client's snapshot and answers the run `accepted` (202) without waiting for it: the pod syncs the snapshot (base fetched from origin with the repository's credential, the uploaded bundle on top) and starts the command detached. Follow it on the stream. Only a redacted preview of the argv and the names of the forwarded environment variables are stored. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json post /api/v1/org/workspaces/{workspace_id}/runs openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Organisation IAM description: >- Custom organisation roles and scoped role assignments for member and service-account identities. - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: Ankra Cloud Clusters description: >- Provision and manage self-managed kubeadm / k3s clusters on Ankra Cloud servers: a private network, a NAT router and a bastion per cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Pipelines description: >- Pipeline definitions, the approval of the authority they declare, and the caches pipelines keep between runs. - name: Workspaces description: >- Personal workspaces on the organisation's CI pool where a repository's heavy commands run, and the repository profiles they are built from. - name: Deploy Targets description: >- Environments, the hosts registered to receive deployments, and the releases deployed to them. - name: Backups description: >- Backup vaults, restore points, protection posture and captures for stacks and application deployments; a completed capture is not a verified restore. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Services description: >- Versioned service packages and explicit sharing. Runtime admission is separate from publication. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Management description: >- Customer agent lifecycle, authenticated identity and organisation automation controls. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Remediation description: >- The organisation's auto-remediation policy: what the AI lanes may fix by themselves, and who approves the rest. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Decisions description: >- The decision ledger behind the Security and Cost queues: proposals a surface computed, the approve and set-aside decisions people took on them, and the receipts of running them. - name: Usage description: >- What your organisation used of Ankra - vCPU-hours, playgrounds, managed services, hosted logs and metrics, and AI - per meter and period, with how completely it was measured and whether a published rate applies. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account description: >- Your own account: the contact email Ankra mails when it differs from your sign-in address. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Ankra Cloud Credentials description: >- Ankra Cloud API tokens, shared by the self-managed and managed Ankra Cloud lanes. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: Object Storage Buckets description: >- Buckets Ankra creates and manages on an organisation's own provider credentials. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Avura description: >- The linked Avura organization, the domains it shares with Ankra Platform, and their DNS records. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /api/v1/org/workspaces/{workspace_id}/runs: post: tags: - Workspaces summary: Start a workspace run description: >- Bearer PAT authentication; RBAC permission `workspaces.use` for the caller's own workspace, `workspaces.manage` for another member's. Starts a command in the workspace against the client's snapshot and answers the run `accepted` (202) without waiting for it: the pod syncs the snapshot (base fetched from origin with the repository's credential, the uploaded bundle on top) and starts the command detached. Follow it on the stream. Only a redacted preview of the argv and the names of the forwarded environment variables are stored. operationId: start_workspace_run_pat parameters: - description: PAT organisation override. in: header name: x-ankra-organisation-id required: false schema: type: string - description: The workspace. in: path name: workspace_id required: true schema: format: uuid type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/WorkspaceRunRequest' required: true responses: '202': content: application/json: schema: $ref: '#/components/schemas/WorkspaceRun' description: The run, accepted '400': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: The request failed validation; the detail names the field '401': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Unauthenticated '403': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Permission check failed '404': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Workspace or run not found '409': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: >- The workspace is not ready (`WORKSPACE_NOT_READY`), the organisation has no ready backup vault, or the named bundle has not been uploaded '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Request validation failed '500': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: Internal failure '502': content: application/json: schema: $ref: '#/components/schemas/ContractDetailError' description: A pod script in the workspace refused, with its own explanation '503': content: application/json: schema: $ref: '#/components/schemas/WorkspaceUnavailableError' description: >- The cluster is offline, has no agent, or the agent did not answer (`CLUSTER_OFFLINE`, `NO_AGENT`, `AGENT_TIMEOUT`) security: - BearerAuth: [] components: schemas: WorkspaceRunRequest: description: A command to run in the workspace against the client's snapshot. properties: agent_id: description: The client worktree's id; each gets its own worktree in the pod. maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._-]*$ type: string apply: description: 'Run a writer: its changes come back as a `patch` export.' type: boolean argv: description: The command, run without a shell. items: type: string maxItems: 1024 minItems: 1 type: array base_ref: description: The client's origin default branch, `refs/remotes/origin/`. type: string base_sha: description: The commit base_ref points at. type: string bundle_object_key: description: >- The uploaded delta bundle (`object_key` of the bundles route); omitted when the workspace lacks nothing. type: - string - 'null' cwd_prefix: description: The client's directory relative to its worktree root. type: string env: additionalProperties: type: string description: Forwarded environment, held to the server allowlist. type: object head_sha: description: The client's HEAD. type: string shallow: description: The boundary commits of a shallow client clone. items: type: string type: array snapshot_sha: description: The commit of the client's working tree. type: string required: - agent_id - argv - snapshot_sha - head_sha title: WorkspaceRunRequest type: object WorkspaceRun: description: One command run in a workspace. properties: apply: type: boolean argv_preview: description: >- The command line with secret-shaped arguments masked, at most 200 characters. type: string base_ref: type: string base_sha: type: string bundle_object_key: type: - string - 'null' created_at: format: date-time type: string cwd_prefix: type: string env_names: description: >- The names of the forwarded environment variables, never their values. items: type: string type: array exit_code: description: >- The command's exit code, or with `started` false why it never started (197: resend the full history, 75: the sync failed, 130: cancelled first). type: - integer - 'null' finished_at: description: When the run ended; null while it has not. format: date-time type: - string - 'null' head_sha: type: string run_id: format: uuid type: string snapshot_sha: type: string started: description: >- Whether the command itself started; null when the record alone cannot tell (a cancelled or lost run). type: - boolean - 'null' state: enum: - accepted - running - finished - not_started - cancelled - lost type: string user_id: format: uuid type: string workspace_id: format: uuid type: string required: - run_id - workspace_id - user_id - state - exit_code - started - argv_preview - env_names - cwd_prefix - snapshot_sha - head_sha - base_ref - base_sha - bundle_object_key - apply - created_at - finished_at title: WorkspaceRun type: object ContractDetailError: example: detail: Cluster not found properties: detail: oneOf: - type: string - additionalProperties: true properties: {} type: object required: - detail type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object WorkspaceUnavailableError: properties: detail: type: string error_code: enum: - CLUSTER_OFFLINE - NO_AGENT - AGENT_TIMEOUT - SANDBOX_MODE - WORKSPACE_NOT_READY type: string retry_after: type: - integer - 'null' required: - error_code - detail - retry_after title: WorkspaceUnavailableError type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object securitySchemes: BearerAuth: bearerFormat: PAT scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.