A workspace is the primary isolation unit in Underlayer. Every task, cron job, API key, and activity log belongs to exactly one workspace. Different workspaces are fully isolated from each other.

Common workspace patterns

• One workspace per environment, e.g. acme-production and acme-staging
• One workspace per team or product area
• One workspace per customer (for multi-tenant setups)

Workspace scope in API

Scheduler endpoints are workspace-scoped by your credentials (X-Api-Key or session + workspace context). You do not pass a workspace slug in these routes:

/api/v1/scheduler/tasks
/api/v1/scheduler/cronjobs
/api/v1/scheduler/runs

Environment variables

Workspaces support environment variables: key/value pairs stored securely and available as template tokens in task URLs and payloads. This lets you avoid hardcoding secrets or environment-specific URLs in your task definitions.

Use double curly braces in templates: {{MY_KEY}}. At dispatch time, Underlayer substitutes each token with the workspace value.

URL template:
https://api.example.com/hooks/{{TENANT_ID}}

Payload template:
{
  "customer_id": "{{CUSTOMER_ID}}",
  "env": "{{ENV_NAME}}"
}

• Undefined tokens stay unresolved, so validate templates before production use.
• Keep secret values in environment variables, not hardcoded in task payloads.

Workspace settings

From Settings you can:

• Rename the workspace
• Manage API keys
• Manage environment variables
• Manage members and their roles
• Delete the workspace