# Workspaces, Team and API Keys

> Organise Edesy Voice API usage into workspaces, invite teammates with owner, admin or member roles, and create and revoke API keys.

Source: https://edesy.in/docs/voice-api/account/workspaces-team-and-api-keys

A workspace is the unit that owns numbers, calls, campaigns, the wallet and API keys. One Edesy login can belong to several workspaces, for example one per business or one for testing, and you switch between them in the portal. Invite teammates as admins or members, and create a separate API key for each service that calls the API.

## Workspaces

| Method | Path | Description |
|---|---|---|
| `GET` | `/v1/workspaces` | Workspaces you belong to |
| `GET` | `/v1/workspaces/current` | The active workspace |
| `POST` | `/v1/workspaces` | Create a workspace |
| `POST` | `/v1/workspaces/{id}/switch` | Switch to a workspace |
| `POST` | `/v1/workspaces/{id}/default` | Make it your default |

These are dashboard-session endpoints. An API key always acts on the workspace it was created in. The workspace ID is also your Account SID for Basic auth. See [Authentication](https://edesy.in/docs/voice-api/getting-started/authentication).

The same Edesy login (single sign-on) works on every Edesy app, so a workspace's team can use the Voice API portal, IVR Studio and the other product portals without separate accounts.

## Team

| Role | Can do |
|---|---|
| `owner` | Everything, including billing and team management. Created with the workspace |
| `admin` | Manage numbers, calls, keys, webhooks and team |
| `member` | Day-to-day use of the workspace |

| Method | Path | Description |
|---|---|---|
| `GET` | `/v1/team/members` | List members |
| `PATCH` | `/v1/team/members/{id}/role` | Change a member's role |
| `DELETE` | `/v1/team/members/{id}` | Remove a member |
| `POST` | `/v1/team/leave` | Leave the workspace |
| `GET` | `/v1/team/invitations` | Pending invitations |
| `POST` | `/v1/team/invitations` | Invite: `{"email": "...", "role": "admin"}` or `"member"` |
| `POST` | `/v1/team/invitations/{id}/resend` | Resend an invitation email |
| `DELETE` | `/v1/team/invitations/{id}` | Revoke an invitation |

## API keys

| Method | Path | Description |
|---|---|---|
| `GET` | `/v1/api-keys` | List keys (prefix, name, last used, expiry) |
| `POST` | `/v1/api-keys` | Create a key |
| `DELETE` | `/v1/api-keys/{id}` | Revoke a key |

```bash
curl -X POST https://voice-api.edesy.in/v1/api-keys \
  -H "Authorization: Bearer $EDESY_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "billing-service", "expires_at": "2027-10-28T00:00:00Z" }'
```

The response contains the full key in `secret`, starting with `sk_`. It is shown only once; store it in your secret manager. Later listings show only `key_prefix` and `last_used_at`.

Good practice:

- One key per service or environment, so you can revoke one without an outage elsewhere.
- Set `expires_at` on keys for contractors or short projects.
- Revoke keys you no longer use; `last_used_at` tells you which.

## Account credentials

The Account SID and Auth Token for Twilio-style Basic auth are on the credentials card of the portal dashboard. The Auth Token can be regenerated there; the old one stops working immediately.