> ## Documentation Index
> Fetch the complete documentation index at: https://docs.checkfu.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Resolve work-workspace requirements

> Compiles explicit provider-neutral requirements or one versioned preset and explains the platform path without allocating, waking, reserving UsageBudget…



## OpenAPI

````yaml /openapi.json post /v1/work-environments/resolve
openapi: 3.1.0
info:
  title: Checkfu API
  version: '2026-08-31'
  description: >-
    Authentication is declared per operation: API-key, runtime, or connector
    bearer; Automation signature; or credential-free pairing redemption. Every
    general Checkfu REST request requires the dated `Checkfu-Version` header
    (one of: 2026-08-31); the three MCP JSON-RPC transports use
    `MCP-Protocol-Version`, A2A uses `A2A-Version`, and the provider OAuth
    callback carries neither Checkfu header. API keys resolve one Workspace
    without a request selector; authenticated responses identify it with
    `Checkfu-Workspace-Id`.
servers:
  - url: https://api.checkfu.com
security:
  - bearerAuth: []
tags:
  - name: organizations
  - name: sourceRepositories
  - name: tenants
  - name: workspaces
  - name: principals
  - name: principalGroups
  - name: principalAccessCredentials
  - name: apiKeys
  - name: agents
  - name: harnessRuntime
  - name: permissionAssignments
  - name: actionPolicies
  - name: files
  - name: memoryStores
  - name: modelCredentials
  - name: modelRoutingProfiles
  - name: toolSources
  - name: skills
  - name: skillSources
  - name: agentBlueprints
  - name: skillProposals
  - name: instructionProposals
  - name: catalog
  - name: managedTools
  - name: concepts
  - name: support
  - name: connections
  - name: connectionVaults
  - name: connectionAssignments
  - name: connectedRuntimes
  - name: fileTrees
  - name: collaboration
  - name: automationGraphs
  - name: automations
  - name: actionApprovals
  - name: standingApprovals
  - name: workloadReviewPolicies
  - name: usage
  - name: models
  - name: outcomes
  - name: budgets
  - name: billing
  - name: sessions
  - name: audit
  - name: sessionExports
  - name: runs
  - name: runnerPools
  - name: transcripts
  - name: sessionWatches
  - name: sessionCapsules
  - name: sessionTrajectories
  - name: webhookEndpoints
  - name: integrationGateway
  - name: workEnvironments
  - name: computers
  - name: computerScreens
  - name: computerBrowserObservations
  - name: computerBrowserActions
  - name: environments
  - name: computerHeadlessOperations
  - name: vaults
  - name: apiMcp
  - name: a2a
paths:
  /v1/work-environments/resolve:
    post:
      tags:
        - workEnvironments
      summary: Resolve work-workspace requirements
      description: >-
        Compiles explicit provider-neutral requirements or one versioned preset
        and explains the platform path without allocating, waking, reserving
        UsageBudget, or contacting a provider. A composition input additionally
        carries the requested Computer overlay — its target requirements,
        affinity, ownership permissions, and remote authorization — and explains
        the joint execution/Computer admission in one deterministic answer:
        effective affinity with its source, colocated-versus-detached selection,
        per-side ownership, and bounded pair-level refusals. The response
        returns normalized requirements, the no-compute, SessionSandbox, or
        Computer class, every considered provider and stable rejection reason,
        warnings, estimated usage dimensions, portability grade, and
        manifest-bound digests. Current support resolves conversation-only and
        existing SessionSandbox intent; Computer intent and every composition
        remain inspectable refusals until qualified provider candidates and
        server-owned enrollment exist. This read authorizes nothing and creation
        re-evaluates all live authority.


        Checkfu support posture: alpha; hosted. Required evidence journey:
        session-turn. Deployment-specific readiness and the latest proven
        release are available from GET /v1/support/capabilities.
      operationId: workEnvironments.resolveWorkEnvironment
      parameters:
        - name: checkfu-version
          in: header
          schema:
            type: string
            enum:
              - '2026-08-31'
          required: true
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/WorkEnvironmentInput'
                - $ref: '#/components/schemas/WorkEnvironmentCompositionInput'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/WorkEnvironmentResolution'
                  - $ref: '#/components/schemas/WorkEnvironmentCompositionResolution'
          headers:
            checkfu-workspace-id:
              description: The Workspace resolved from the authenticated bearer credential.
              required: true
              schema:
                $ref: '#/components/schemas/WorkspaceId'
        '400':
          description: Typed Checkfu wire error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationMalformedError'
        '401':
          description: Typed Checkfu wire error
          content:
            application/json:
              schema:
                type: object
                required:
                  - error
                properties:
                  error:
                    type: object
                    required:
                      - type
                      - message
                      - more
                    properties:
                      type:
                        type: string
                        enum:
                          - auth.invalid_key
                      message:
                        type: string
                      more:
                        type: string
                        enum:
                          - >-
                            https://docs.checkfu.com/reference/errors#auth-invalid-key
                        description: >-
                          Stable public documentation and remedy for this error
                          type.
                    additionalProperties: false
                additionalProperties: false
        '403':
          description: >-
            The organization, tenant, or workspace backing this key is
            administratively disabled. | Deployment governance or retention
            policy denied the request.
          content:
            application/json:
              schema:
                anyOf:
                  - type: object
                    required:
                      - error
                    properties:
                      error:
                        type: object
                        properties:
                          type:
                            type: string
                            enum:
                              - auth.disabled_tenancy
                          message:
                            type: string
                          more:
                            type: string
                            enum:
                              - >-
                                https://docs.checkfu.com/reference/errors#auth-disabled-tenancy
                            description: >-
                              Stable public documentation and remedy for this
                              error type.
                        required:
                          - type
                          - message
                          - more
                        additionalProperties: false
                    additionalProperties: false
                  - $ref: '#/components/schemas/PolicyDeniedError'
        '429':
          description: Typed Checkfu wire error
          headers:
            retry-after:
              description: >-
                Delay in seconds for rate limits or deployment quotas with a
                known release or UTC reset boundary
              required: false
              schema:
                type: integer
                minimum: 1
          content:
            application/json:
              schema:
                type: object
                required:
                  - error
                properties:
                  error:
                    type: object
                    required:
                      - type
                      - message
                      - more
                    properties:
                      type:
                        type: string
                        enum:
                          - budget.exceeded
                      message:
                        type: string
                      more:
                        type: string
                        enum:
                          - >-
                            https://docs.checkfu.com/reference/errors#budget-exceeded
                        description: >-
                          Stable public documentation and remedy for this error
                          type.
                    additionalProperties: false
                additionalProperties: false
        '500':
          description: >-
            An unexpected internal failure occurred; the message contains an
            opaque incident reference.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeInternalError'
      security:
        - bearerAuth: []
components:
  schemas:
    WorkEnvironmentInput:
      anyOf:
        - type: object
          properties:
            input_type:
              type: string
              enum:
                - preset
            preset:
              type: string
              enum:
                - conversation_only
                - sandbox_ephemeral
                - sandbox_durable
                - browser_isolated
                - browser_shared_profile
                - desktop_isolated
                - desktop_shared_filesystem
                - connected_computer
            overrides:
              type: object
              properties:
                execution:
                  $ref: '#/components/schemas/Arrays_47'
                computer_capabilities:
                  $ref: '#/components/schemas/WorkEnvironmentComputerCapabilities'
                placement:
                  $ref: '#/components/schemas/Arrays_48'
                locality:
                  type: object
                  properties:
                    regions:
                      $ref: '#/components/schemas/Arrays_49'
                    residency_required:
                      type: boolean
                  required:
                    - regions
                    - residency_required
                  additionalProperties: false
                resources:
                  type: object
                  properties:
                    minimum_vcpu:
                      anyOf:
                        - type: integer
                          allOf:
                            - exclusiveMinimum: 0
                            - maximum: 1024
                        - type: 'null'
                    minimum_memory_mib:
                      anyOf:
                        - type: integer
                          allOf:
                            - exclusiveMinimum: 0
                            - maximum: 4194304
                        - type: 'null'
                    minimum_disk_mib:
                      anyOf:
                        - type: integer
                          allOf:
                            - exclusiveMinimum: 0
                            - maximum: 1073741824
                        - type: 'null'
                    gpu:
                      $ref: '#/components/schemas/Union_343'
                  required:
                    - minimum_vcpu
                    - minimum_memory_mib
                    - minimum_disk_mib
                    - gpu
                  additionalProperties: false
              additionalProperties: false
          required:
            - input_type
            - preset
          additionalProperties: false
        - type: object
          properties:
            input_type:
              type: string
              enum:
                - requirements
            requirements:
              $ref: '#/components/schemas/WorkEnvironmentRequirements'
          required:
            - input_type
            - requirements
          additionalProperties: false
      description: >-
        Explicit requirements or a versioned convenience preset with safe
        overrides.
    WorkEnvironmentCompositionInput:
      type: object
      properties:
        input_type:
          type: string
          enum:
            - composition
        execution:
          $ref: '#/components/schemas/WorkEnvironmentInput'
        computer:
          type: object
          properties:
            requirements:
              $ref: '#/components/schemas/WorkEnvironmentInput'
            affinity:
              anyOf:
                - type: object
                  properties:
                    type:
                      type: string
                      enum:
                        - same_execution_environment
                    required_shared:
                      type: array
                      items:
                        type: string
                        enum:
                          - display
                          - filesystem
                          - network
                          - process_namespace
                      allOf:
                        - maxItems: 4
                  required:
                    - type
                    - required_shared
                  additionalProperties: false
                - type: object
                  properties:
                    type:
                      type: string
                      enum:
                        - remote_permitted
                  required:
                    - type
                  additionalProperties: false
            existing_computer:
              anyOf:
                - $ref: '#/components/schemas/ComputerId'
                - type: 'null'
          required:
            - requirements
          additionalProperties: false
        ownership:
          $ref: '#/components/schemas/Objects_223'
        remote:
          $ref: '#/components/schemas/Objects_224'
      required:
        - input_type
        - execution
        - computer
      additionalProperties: false
      description: >-
        Explicit execution requirements plus a requested Computer overlay, with
        affinity, ownership, and remote-authorization policy for one joint
        admission.
    WorkEnvironmentResolution:
      type: object
      properties:
        disposition:
          type: string
          enum:
            - resolved
            - refused
        resolver_version:
          type: string
          enum:
            - work-environment-resolver/v1
        preset_catalog_version:
          type: number
          enum:
            - 1
        normalized_requirements:
          $ref: '#/components/schemas/WorkEnvironmentRequirements'
        resolved_kind:
          type: string
          enum:
            - none
            - session_sandbox
            - computer
        requires_screen:
          type: boolean
        forced_by:
          type: array
          items:
            type: string
            allOf:
              - minLength: 1
              - maxLength: 128
              - pattern: ^[a-z_]+(?:\.[a-z_]+)*$
          allOf:
            - maxItems: 16
        selected_provider:
          anyOf:
            - type: object
              properties:
                provider:
                  type: string
                  allOf:
                    - minLength: 1
                    - maxLength: 128
                    - pattern: ^[a-z0-9][a-z0-9._-]*$
                tuple_digest:
                  type: string
                  pattern: ^sha256:[0-9a-f]{64}$
                evidence_grade:
                  type: string
                  enum:
                    - double
                    - live_qualified
              required:
                - provider
                - tuple_digest
                - evidence_grade
              additionalProperties: false
            - type: 'null'
        considered:
          type: array
          items:
            $ref: '#/components/schemas/Objects_225'
          allOf:
            - maxItems: 64
        warnings:
          type: array
          items:
            type: object
            properties:
              code:
                anyOf:
                  - type: string
                    enum:
                      - shared_profile_credentials
              message:
                type: string
                allOf:
                  - minLength: 1
                  - maxLength: 512
              acknowledgement_required:
                type: boolean
            required:
              - code
              - message
              - acknowledgement_required
            additionalProperties: false
          allOf:
            - maxItems: 16
        estimated_usage_dimensions:
          type: array
          items:
            $ref: '#/components/schemas/Union_355'
          allOf:
            - maxItems: 3
        refusal:
          anyOf:
            - $ref: '#/components/schemas/WorkEnvironmentRefusal'
            - type: 'null'
        portability:
          type: string
          enum:
            - not_applicable
            - unproved
            - single_live_provider
            - portable
        candidate_set_digest:
          type: string
          pattern: ^sha256:[0-9a-f]{64}$
        resolution_digest:
          type: string
          pattern: ^sha256:[0-9a-f]{64}$
      required:
        - disposition
        - resolver_version
        - preset_catalog_version
        - normalized_requirements
        - resolved_kind
        - requires_screen
        - forced_by
        - selected_provider
        - considered
        - warnings
        - estimated_usage_dimensions
        - refusal
        - portability
        - candidate_set_digest
        - resolution_digest
      additionalProperties: false
      description: >-
        A deterministic allocation-free explanation of work-environment
        admission.
    WorkEnvironmentCompositionResolution:
      type: object
      properties:
        execution:
          $ref: '#/components/schemas/WorkEnvironmentResolution'
        composition:
          $ref: '#/components/schemas/WorkEnvironmentCompositionOutcome'
      required:
        - execution
        - composition
      additionalProperties: false
      description: >-
        The singular execution-side resolution plus the joint composition
        outcome for a requested Computer overlay.
    WorkspaceId:
      type: string
      pattern: ^wrkspc_[0-9a-f]{32}$
    ValidationMalformedError:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
                - validation.malformed
            message:
              type: string
            more:
              type: string
              enum:
                - https://docs.checkfu.com/reference/errors#validation-malformed
              description: Stable public documentation and remedy for this error type.
          required:
            - type
            - message
            - more
          additionalProperties: false
      required:
        - error
      additionalProperties: false
      description: >-
        The request could not be decoded or violated a declared input
        constraint.
    PolicyDeniedError:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
                - policy.denied
            message:
              type: string
            more:
              type: string
              enum:
                - https://docs.checkfu.com/reference/errors#policy-denied
              description: Stable public documentation and remedy for this error type.
          required:
            - type
            - message
            - more
          additionalProperties: false
      required:
        - error
      additionalProperties: false
      description: Deployment governance or retention policy denied the request.
    RuntimeInternalError:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
                - runtime.internal
            message:
              type: string
            more:
              type: string
              enum:
                - https://docs.checkfu.com/reference/errors#runtime-internal
              description: Stable public documentation and remedy for this error type.
          required:
            - type
            - message
            - more
          additionalProperties: false
      required:
        - error
      additionalProperties: false
      description: >-
        An unexpected internal failure occurred; the message contains an opaque
        incident reference.
    Arrays_47:
      type: array
      items:
        $ref: '#/components/schemas/Union_339'
      allOf:
        - maxItems: 6
    WorkEnvironmentComputerCapabilities:
      type: object
      properties:
        observation:
          $ref: '#/components/schemas/WorkEnvironmentComputerObservationNeeds'
        actions:
          $ref: '#/components/schemas/WorkEnvironmentComputerActionNeeds'
      additionalProperties: false
      allOf:
        - minProperties: 1
    Arrays_48:
      type: array
      items:
        $ref: '#/components/schemas/Union_342'
      allOf:
        - maxItems: 3
    Arrays_49:
      type: array
      items:
        type: string
        allOf:
          - minLength: 1
          - maxLength: 64
          - pattern: ^[a-z0-9][a-z0-9-]*$
      allOf:
        - maxItems: 32
    Union_343:
      type: string
      enum:
        - forbidden
        - optional
        - required
    WorkEnvironmentRequirements:
      type: object
      properties:
        schema_version:
          type: number
          enum:
            - 1
        execution:
          $ref: '#/components/schemas/Arrays_47'
        lifetime:
          $ref: '#/components/schemas/Union_344'
        presentation:
          $ref: '#/components/schemas/Union_345'
        human_access:
          $ref: '#/components/schemas/Union_346'
        computer_capabilities:
          $ref: '#/components/schemas/WorkEnvironmentComputerCapabilities'
        placement:
          $ref: '#/components/schemas/Arrays_48'
        isolation:
          type: object
          properties:
            filesystem:
              $ref: '#/components/schemas/Union_347'
            browser_profile:
              $ref: '#/components/schemas/Union_347'
            process_namespace:
              $ref: '#/components/schemas/Union_347'
            credentials:
              type: string
              enum:
                - grant_bound
                - profile_shared
            clipboard:
              $ref: '#/components/schemas/Union_348'
            downloads:
              $ref: '#/components/schemas/Union_347'
          required:
            - filesystem
            - browser_profile
            - process_namespace
            - credentials
            - clipboard
            - downloads
          additionalProperties: false
        recovery:
          $ref: '#/components/schemas/Union_349'
        retention:
          $ref: '#/components/schemas/WorkEnvironmentRetention'
        network:
          $ref: '#/components/schemas/WorkEnvironmentNetwork'
        locality:
          $ref: '#/components/schemas/WorkEnvironmentLocality'
        resources:
          $ref: '#/components/schemas/WorkEnvironmentResources'
      required:
        - schema_version
        - execution
        - lifetime
        - presentation
        - human_access
        - placement
        - isolation
        - recovery
        - retention
        - network
        - locality
        - resources
      additionalProperties: false
    ComputerId:
      type: string
      pattern: ^comp_[0-9a-f]{32}$
    Objects_223:
      type: object
      properties:
        execution:
          $ref: '#/components/schemas/Arrays_51'
        computer:
          $ref: '#/components/schemas/Arrays_51'
      required:
        - execution
        - computer
      additionalProperties: false
    Objects_224:
      type: object
      properties:
        spend_authorized:
          type: boolean
        data_egress_authorized:
          type: boolean
      required:
        - spend_authorized
        - data_egress_authorized
      additionalProperties: false
    Objects_225:
      type: object
      properties:
        provider:
          type: string
          allOf:
            - minLength: 1
            - maxLength: 128
            - pattern: ^[a-z0-9][a-z0-9._-]*$
        tuple_digest:
          type: string
          pattern: ^sha256:[0-9a-f]{64}$
        qualified:
          type: boolean
        reasons:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                enum:
                  - live_qualification_missing
                  - execution_unsupported
                  - lifetime_unsupported
                  - presentation_unsupported
                  - human_access_unsupported
                  - observation_transport_unsafe
                  - observation_unsupported
                  - action_unsupported
                  - exclusive_control_unfenced
                  - placement_unsupported
                  - recovery_unsupported
                  - retention_unsupported
                  - network_unsupported
                  - network_enforcement_unsupported
                  - network_policy_unqualified
                  - region_unsupported
                  - resource_insufficient
                  - gpu_unsupported
                  - isolation_unsupported
              requirement_path:
                type: string
                allOf:
                  - minLength: 1
                  - maxLength: 128
                  - pattern: ^[a-z_]+(?:\.[a-z_]+)*$
              expected:
                type: string
                allOf:
                  - minLength: 1
                  - maxLength: 512
              observed:
                type: string
                allOf:
                  - minLength: 1
                  - maxLength: 512
              evidence_reference:
                anyOf:
                  - type: string
                    allOf:
                      - minLength: 1
                      - maxLength: 512
                  - type: 'null'
            required:
              - code
              - requirement_path
              - expected
              - observed
              - evidence_reference
            additionalProperties: false
          allOf:
            - maxItems: 64
      required:
        - provider
        - tuple_digest
        - qualified
        - reasons
      additionalProperties: false
    Union_355:
      type: string
      enum:
        - compute_seconds
        - screen_seconds
        - storage_mib_seconds
    WorkEnvironmentRefusal:
      type: object
      properties:
        code:
          type: string
          enum:
            - human_access_requires_presentation
            - browser_presentation_requires_browser_visual
            - desktop_presentation_requires_desktop_gui
            - computer_capabilities_target_mismatch
            - browser_recovery_requires_browser
            - recovery_requires_durable_lifetime
            - zdr_forbids_shared_credentials
            - zdr_forbids_export
            - bounded_retention_requires_maximum
            - unbounded_retention_forbids_maximum
            - allowlist_requires_policy_revision
            - network_policy_revision_not_applicable
            - network_policy_unresolved
            - residency_requires_region
            - compute_requires_placement
            - durable_lifetime_requires_execution
            - resources_require_execution
            - shared_isolation_requires_durable_lifetime
            - override_weakens_preset
            - provider_candidate_limit_exceeded
            - duplicate_provider_candidate
            - no_qualified_provider
            - authorization_denied
            - budget_denied
        requirement_path:
          type: string
          allOf:
            - minLength: 1
            - maxLength: 128
            - pattern: ^[a-z_]+(?:\.[a-z_]+)*$
        message:
          type: string
          allOf:
            - minLength: 1
            - maxLength: 512
      required:
        - code
        - requirement_path
        - message
      additionalProperties: false
      description: A stable, provider-neutral reason a work environment cannot be admitted.
    WorkEnvironmentCompositionOutcome:
      type: object
      properties:
        disposition:
          type: string
          enum:
            - refused
            - resolved
        resolver_version:
          type: string
          enum:
            - work-environment-composition-resolver/v1
        effective_affinity:
          $ref: '#/components/schemas/Union_353'
        affinity_source:
          type: string
          enum:
            - conservative_default
            - explicit
            - recipe_normalized
        normalized_computer_requirements:
          $ref: '#/components/schemas/WorkEnvironmentRequirements'
        requires_screen:
          type: boolean
        permitted_owners:
          $ref: '#/components/schemas/Objects_223'
        remote:
          $ref: '#/components/schemas/Objects_224'
        considered_computer:
          type: array
          items:
            $ref: '#/components/schemas/Objects_225'
          allOf:
            - maxItems: 64
        selected:
          anyOf:
            - $ref: '#/components/schemas/WorkEnvironmentCompositionSelection'
            - type: 'null'
        estimated_usage_dimensions:
          type: array
          items:
            $ref: '#/components/schemas/Union_355'
          allOf:
            - maxItems: 3
        refusal:
          anyOf:
            - $ref: '#/components/schemas/WorkEnvironmentCompositionRefusal'
            - type: 'null'
        execution_candidate_set_digest:
          type: string
          pattern: ^sha256:[0-9a-f]{64}$
        computer_candidate_set_digest:
          type: string
          pattern: ^sha256:[0-9a-f]{64}$
        colocation_set_digest:
          type: string
          pattern: ^sha256:[0-9a-f]{64}$
        composition_digest:
          type: string
          pattern: ^sha256:[0-9a-f]{64}$
      required:
        - disposition
        - resolver_version
        - effective_affinity
        - affinity_source
        - normalized_computer_requirements
        - requires_screen
        - permitted_owners
        - remote
        - considered_computer
        - selected
        - estimated_usage_dimensions
        - refusal
        - execution_candidate_set_digest
        - computer_candidate_set_digest
        - colocation_set_digest
        - composition_digest
      additionalProperties: false
      description: >-
        A deterministic allocation-free explanation of one execution/Computer
        composition admission.
    Union_339:
      type: string
      enum:
        - shell
        - filesystem
        - network_server
        - browser_dom
        - browser_visual
        - desktop_gui
    WorkEnvironmentComputerObservationNeeds:
      type: object
      properties:
        accessibility_tree:
          type: string
          enum:
            - required
            - optional
        screenshot:
          type: string
          enum:
            - required
            - optional
        window_inventory:
          type: string
          enum:
            - required
            - optional
      additionalProperties: false
      allOf:
        - minProperties: 1
    WorkEnvironmentComputerActionNeeds:
      type: object
      properties:
        navigate:
          type: string
          enum:
            - required
            - optional
        click:
          type: string
          enum:
            - required
            - optional
        type_text:
          type: string
          enum:
            - required
            - optional
        keypress:
          type: string
          enum:
            - required
            - optional
        scroll:
          type: string
          enum:
            - required
            - optional
        switch_target:
          type: string
          enum:
            - required
            - optional
        close_target:
          type: string
          enum:
            - required
            - optional
        drag:
          type: string
          enum:
            - required
            - optional
        accessible_node:
          type: string
          enum:
            - required
            - optional
      additionalProperties: false
      allOf:
        - minProperties: 1
    Union_342:
      type: string
      enum:
        - managed
        - local
        - connected
    Union_344:
      type: string
      enum:
        - run
        - session
        - durable
    Union_345:
      type: string
      enum:
        - none
        - browser
        - desktop
    Union_346:
      type: string
      enum:
        - none
        - observe
        - exclusive_takeover
    Union_347:
      type: string
      enum:
        - attachment
        - application
        - scope_shared
    Union_348:
      type: string
      enum:
        - disabled
        - attachment
        - scope_shared
    Union_349:
      type: string
      enum:
        - none
        - filesystem
        - browser_profile
        - full_instance
    WorkEnvironmentRetention:
      type: object
      properties:
        mode:
          $ref: '#/components/schemas/Union_350'
        maximum_seconds:
          anyOf:
            - type: integer
              allOf:
                - exclusiveMinimum: 0
                - maximum: 315360000
            - type: 'null'
        export:
          type: string
          enum:
            - forbidden
            - allowed
      required:
        - mode
        - maximum_seconds
        - export
      additionalProperties: false
      description: >-
        Retention duration, durability mode, and export policy for a work
        environment.
    WorkEnvironmentNetwork:
      anyOf:
        - type: object
          properties:
            mode:
              $ref: '#/components/schemas/Union_351'
            policy:
              anyOf:
                - type: object
                  properties:
                    action_policy_id:
                      $ref: '#/components/schemas/ActionPolicyId'
                    action_policy_version:
                      type: integer
                      exclusiveMinimum: 0
                  required:
                    - action_policy_id
                    - action_policy_version
                  additionalProperties: false
                - type: 'null'
          required:
            - mode
            - policy
          additionalProperties: false
        - $ref: '#/components/schemas/Union_352'
      description: >-
        Concrete network destinations and enforcement requirements, or a
        retained action-policy reference that cannot authorize network egress.
    WorkEnvironmentLocality:
      type: object
      properties:
        regions:
          $ref: '#/components/schemas/Arrays_49'
        residency_required:
          type: boolean
      required:
        - regions
        - residency_required
      additionalProperties: false
      description: >-
        Ordered eligible regions and residency requirement for a work
        environment.
    WorkEnvironmentResources:
      type: object
      properties:
        minimum_vcpu:
          anyOf:
            - type: integer
              allOf:
                - exclusiveMinimum: 0
                - maximum: 1024
            - type: 'null'
        minimum_memory_mib:
          anyOf:
            - type: integer
              allOf:
                - exclusiveMinimum: 0
                - maximum: 4194304
            - type: 'null'
        minimum_disk_mib:
          anyOf:
            - type: integer
              allOf:
                - exclusiveMinimum: 0
                - maximum: 1073741824
            - type: 'null'
        gpu:
          $ref: '#/components/schemas/Union_343'
      required:
        - minimum_vcpu
        - minimum_memory_mib
        - minimum_disk_mib
        - gpu
      additionalProperties: false
      description: >-
        Minimum compute, memory, disk, and GPU requirements for a work
        environment.
    Arrays_51:
      type: array
      items:
        $ref: '#/components/schemas/Union_354'
      allOf:
        - maxItems: 2
    Union_353:
      anyOf:
        - type: object
          properties:
            type:
              type: string
              enum:
                - same_execution_environment
            required_shared:
              type: array
              items:
                type: string
                enum:
                  - display
                  - filesystem
                  - network
                  - process_namespace
              allOf:
                - maxItems: 4
          required:
            - type
            - required_shared
          additionalProperties: false
        - type: object
          properties:
            type:
              type: string
              enum:
                - remote_permitted
          required:
            - type
          additionalProperties: false
    WorkEnvironmentCompositionSelection:
      type: object
      properties:
        topology:
          type: string
          enum:
            - colocated
            - detached
        execution:
          $ref: '#/components/schemas/Objects_226'
        computer:
          $ref: '#/components/schemas/Objects_226'
        colocation:
          anyOf:
            - type: object
              properties:
                allocation_identity:
                  type: string
                  allOf:
                    - minLength: 1
                    - maxLength: 128
                    - pattern: ^[a-z0-9][a-z0-9._-]*$
                provider_account:
                  type: string
                  allOf:
                    - minLength: 1
                    - maxLength: 128
                    - pattern: ^[a-z0-9][a-z0-9._-]*$
                shared_display:
                  type: boolean
                shared_filesystem:
                  type: boolean
                shared_network:
                  type: boolean
                shared_process_namespace:
                  type: boolean
              required:
                - allocation_identity
                - provider_account
                - shared_display
                - shared_filesystem
                - shared_network
                - shared_process_namespace
              additionalProperties: false
            - type: 'null'
      required:
        - topology
        - execution
        - computer
        - colocation
      additionalProperties: false
      description: >-
        The deterministically selected execution/Computer pair with its proved
        topology, ownership, and colocation facts.
    WorkEnvironmentCompositionRefusal:
      type: object
      properties:
        code:
          type: string
          enum:
            - human_access_requires_presentation
            - browser_presentation_requires_browser_visual
            - desktop_presentation_requires_desktop_gui
            - computer_capabilities_target_mismatch
            - browser_recovery_requires_browser
            - recovery_requires_durable_lifetime
            - zdr_forbids_shared_credentials
            - zdr_forbids_export
            - bounded_retention_requires_maximum
            - unbounded_retention_forbids_maximum
            - allowlist_requires_policy_revision
            - network_policy_revision_not_applicable
            - network_policy_unresolved
            - residency_requires_region
            - compute_requires_placement
            - durable_lifetime_requires_execution
            - resources_require_execution
            - shared_isolation_requires_durable_lifetime
            - override_weakens_preset
            - provider_candidate_limit_exceeded
            - duplicate_provider_candidate
            - no_qualified_provider
            - authorization_denied
            - budget_denied
            - composition_requires_execution
            - composition_overlay_requires_computer
            - composition_candidate_limit_exceeded
            - duplicate_composition_candidate
            - duplicate_colocation_binding
            - prohibited_owner
            - explicit_target_unavailable
            - same_environment_mismatch
            - detached_access_not_authorized
            - no_qualified_composition
        requirement_path:
          type: string
          allOf:
            - minLength: 1
            - maxLength: 128
            - pattern: ^[a-z_]+(?:\.[a-z_]+)*$
        message:
          type: string
          allOf:
            - minLength: 1
            - maxLength: 512
      required:
        - code
        - requirement_path
        - message
      additionalProperties: false
      description: >-
        A stable, provider-neutral reason a work-environment composition cannot
        be admitted.
    Union_350:
      type: string
      enum:
        - ephemeral_zdr
        - bounded
        - durable
    Union_351:
      type: string
      enum:
        - none
        - allowlist
        - unrestricted
    ActionPolicyId:
      type: string
      pattern: ^apol_[0-9a-f]{32}$
    Union_352:
      anyOf:
        - type: object
          properties:
            mode:
              type: string
              enum:
                - none
            allowed_hosts:
              $ref: '#/components/schemas/Arrays_50'
          required:
            - mode
            - allowed_hosts
          additionalProperties: false
        - type: object
          properties:
            mode:
              type: string
              enum:
                - unrestricted
            allowed_hosts:
              $ref: '#/components/schemas/Arrays_50'
          required:
            - mode
            - allowed_hosts
          additionalProperties: false
        - $ref: '#/components/schemas/SandboxAllowlistWithinHostLimit'
    Union_354:
      type: string
      enum:
        - customer
        - managed
    Objects_226:
      type: object
      properties:
        provider:
          type: string
          allOf:
            - minLength: 1
            - maxLength: 128
            - pattern: ^[a-z0-9][a-z0-9._-]*$
        tuple_digest:
          type: string
          pattern: ^sha256:[0-9a-f]{64}$
        evidence_grade:
          type: string
          enum:
            - double
            - live_qualified
        owner:
          $ref: '#/components/schemas/Union_354'
        computer_id:
          anyOf:
            - $ref: '#/components/schemas/ComputerId'
            - type: 'null'
      required:
        - provider
        - tuple_digest
        - evidence_grade
        - owner
        - computer_id
      additionalProperties: false
    Arrays_50:
      type: array
      items:
        $ref: '#/components/schemas/SandboxAllowedHost'
      allOf:
        - maxItems: 0
    SandboxAllowlistWithinHostLimit:
      type: object
      properties:
        mode:
          type: string
          enum:
            - allowlist
        allowed_hosts:
          type: array
          items:
            $ref: '#/components/schemas/SandboxAllowedHost'
          allOf:
            - maxItems: 256
        required_egress_certification:
          type: string
          enum:
            - advisory_filter
            - security_boundary
        allow_package_managers:
          type: boolean
        allow_mcp_servers:
          type: boolean
      required:
        - mode
        - allowed_hosts
      additionalProperties: false
    SandboxAllowedHost:
      type: string
      description: >-
        A lower-case public DNS hostname, never localhost or an IP literal, with
        an optional leading wildcard and TCP port from 1 through 65535.
      allOf:
        - maxLength: 261
        - pattern: >-
            ^(?:\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+(?::[1-9][0-9]{0,4})?$
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.