vrv-panw · Nov 3, 2026 · Nov 3, 2026
@@ -52,7 +52,7 @@ empty, and it would have cost the whole gate the day one was written.
 The four decision files under `_project/` are the same idea applied to
 structure. Each
 holds a decision that would otherwise be spread across the document — sixty-odd
-`servers` blocks, eleven tag groups' worth of operations, 203 page URLs — where
+`servers` blocks, nine tag groups' worth of operations, 207 page URLs — where
 it can be read, reviewed and changed in one place. `scripts/build.py` applies
 them back onto `openapi.yaml` and CI fails if the document and the decisions
 disagree.
@@ -62,21 +62,26 @@ disagree.
 | | |
 |---|---|
 | OpenAPI | 3.0.0 |
-| Paths / operations | 131 / 203 |
-| Components | 521, of which 479 schemas |
-| Tags | 46, across 6 navigation groups |
-| Servers | 5 hosts across 4 planes — managed and self-hosted gateway, control plane, admin, admin-in-path |
+| Paths / operations | 133 / 207 |
+| Components | 535, of which 486 schemas |
+| Tags | 47, across 6 navigation groups |
+| Servers | 6 hosts across 5 planes — managed and self-hosted gateway, control plane, admin, admin-in-path, Workspace Service |
 | Security | 1 scheme: `Authorization: Bearer` |
-| Docs URLs | 203 — one `x-mint.href` per operation, all unique |
+| Docs URLs | 207 — one `x-mint.href` per operation, all unique |
 | Prose fields stripped | 4,221 |
 | Written descriptions | 0 — blocked on KB access |
 
-Eleven capability groups the base carried are **not shipped** — Audit Logs,
-Collections, Labels, Log Exports, Prompts, Prompt Partials, User Invites, Users,
-Virtual Keys, Workspaces and Workspaces > Members. That is 63 operations and 34
-paths, declared by tag in `_project/drops.yaml`.
+Nine capability groups the base carried are **not shipped** — Audit Logs,
+Collections, Labels, Log Exports, Prompts, Prompt Partials, User Invites, Users
+and Virtual Keys. That is 50 operations and 28 paths, declared by tag in
+`_project/drops.yaml`.
 
-Deployments was a twelfth until Phase 2, when it turned out to be exposed on the
+**Workspaces** is the Prisma AIRS Workspace Service (`/workspaces`,
+`/workspaces/{id}`) on its own host, `api.sase.paloaltonetworks.com/airs/workspace/v1`,
+from engineering's Workspace Service API 1.0.0 specification. It is where a
+caller finds the UUID that every `workspace_id` parameter asks for.
+
+Deployments was a tenth until Phase 2, when it turned out to be exposed on the
 admin plane after all. Un-dropping is recovery rather than a flag flip: the base
 was retired at the end of Phase 1, so removing the line brought nothing back and
 the six operations were recovered from the pre-drop revision. What came back is
@@ -310,7 +315,7 @@ domain and not subordinate to the KB (recorded exemption, Q6, 2026-09-07). The
 reconciliation loop is therefore three-node — KB ↔ spec ↔ docs — and drift from
 *either* side is a defect, with no authoritative side to fall back on.
 
-`x-airs-provenance` is scaffolded on all 203 operations with `claims` empty. It
+`x-airs-provenance` is scaffolded on all 207 operations with `claims` empty. It
 is not only "which claim supports this description"; it is the **join key that
 makes drift detectable**. Without a claim reference on an operation, nothing can
 tell that the KB moved and the spec did not.
@@ -550,11 +555,10 @@ wanted.
   Until then the generated sample is correct but verbose. cURL only is the
   intended end state — a single `x-codeSamples` entry suppresses the other
   language tabs, and other languages are a separate decision.
-- **`required` is unfilled on five request bodies** — `POST /configs`,
-  `POST /admin/workspaces`, and the `PUT`s for configs, providers and
-  workspaces. `required` is a claim about the API contract and nothing here
-  establishes it; getting it wrong means a reader omits a field the API rejects.
-  For the three `PUT`s, requiring nothing may already be correct, since a
+- **`required` is unfilled on three request bodies** — `POST /configs`
+  and the `PUT`s for configs and providers. `required` is a claim about the API
+  contract and nothing here establishes it; getting it wrong means a reader omits a field the API rejects.
+  For the two `PUT`s, requiring nothing may already be correct, since a
   partial update where every field is optional is a normal design. Wants
   engineering.
 - **117 lint findings are baselined**, all inherited or carried in with ported

@@ -14,8 +14,8 @@
 
 # Vrushank, 2026-09-15, marked [DROPPED] on the Phase 1 drop list.
 #
-# Control-plane capabilities that Prisma AIRS does not expose. Ten of the
-# eleven are control plane throughout. `Prompts` is the exception: it spans
+# Control-plane capabilities that Prisma AIRS does not expose. Eight of the
+# nine are control plane throughout. `Prompts` is the exception: it spans
 # both planes, and dropping only the control-plane side would ship an API
 # where a prompt can be executed but never created, listed or versioned, so
 # the two gateway paths under it go as well.
@@ -34,15 +34,6 @@ tags:
   - User Invites
   - Users
   - Virtual Keys
-  - Workspaces > Members
-
-# Engineering, 2026-09-15. Their list named seven capabilities as dropped;
-# six were already gone above. `Workspaces` is the one that was still
-# shipping. Their list also named "SCIM Workspace Mappings" separately, but
-# the base did not tag it separately: /scim/workspaces{,/{id}} carries the
-# `Workspaces` tag too, so this one line removes both surfaces -- five
-# /admin/workspaces operations and three /scim/workspaces ones.
-  - Workspaces
 
 # Individual operations to drop where the whole tag stays. Empty today: every
 # current removal is a clean tag boundary. Entries are "METHOD /path".

@@ -227,5 +227,9 @@ hrefs:
   DELETE /policies/access/{accessPolicyId}: /aigw/api-reference/access-policies/delete-access-policy
   POST /messages: /aigw/api-reference/messages/create-message
   POST /messages/count_tokens: /aigw/api-reference/messages/count-message-tokens
+  GET /workspaces: /aigw/api-reference/workspaces/list-workspaces
+  POST /workspaces: /aigw/api-reference/workspaces/create-workspace
+  GET /workspaces/{id}: /aigw/api-reference/workspaces/get-workspace
+  PUT /workspaces/{id}: /aigw/api-reference/workspaces/update-workspace
 pinned:
 - POST /threads/{thread_id}/messages
@@ -17,6 +17,7 @@
 #   admin           /ai_gw/admin/v2
 #   admin-in-path   also /ai_gw/admin/v2, but the prefix is in the path key
 #                   rather than the server URL -- see servers.yaml for why
+#   workspace       the Workspace Service, api.sase.paloaltonetworks.com
 #
 # `how` records where the call came from:
 #   classification.yaml  -- a human decided, see that file for the reasoning
@@ -32,6 +33,8 @@
 #                           linkage closed (upstream commits up to adfd74b);
 #                           the plane was decided by Vrushank, not read off
 #                           Portkey's server overrides
+#   workspace-service-1.0.0 -- engineering's Workspace Service API spec
+#                           (2026-11-03); its own host, not an AI Gateway plane
 
 # Tags whose operations are deliberately not all on one plane. `check.py` fails
 # on any other tag that spans two, because the split was decided by capability
@@ -197,3 +200,7 @@ gateway:
   "/vector_stores/{vector_store_id}/file_batches/{batch_id}/files": classification.yaml
   "/vector_stores/{vector_store_id}/files": classification.yaml
   "/vector_stores/{vector_store_id}/files/{file_id}": classification.yaml
+
+workspace:
+  "/workspaces": workspace-service-1.0.0
+  "/workspaces/{id}": workspace-service-1.0.0
@@ -97,3 +97,14 @@ admin:
 admin-in-path:
   - url: https://api.apps.paloaltonetworks.com/ai_gw
     description: Managed
+
+# Workspace Service. A different host and a different service from the AI
+# Gateway planes: workspaces are a Prisma AIRS core resource, bound to an SCM
+# scope, and every workspace-level call on /ai_gw/v2 names one by the `id` this
+# service returns (`workspace_id`, a UUID). Same SCM bearer token.
+#
+# Vrushank, 2026-11-03, from engineering's Workspace Service API 1.0.0
+# specification. Not yet live-verified.
+workspace:
+  - url: https://api.sase.paloaltonetworks.com/airs/workspace/v1
+    description: Managed
@@ -1,22 +1,22 @@
 Generated by scripts/build.py from openapi.yaml.
 
-operations                       203
-paths                            131
-schemas                          479
-tags                             46
+operations                       207
+paths                            133
+schemas                          486
+tags                             47
 
-docs URLs                        203
+docs URLs                        207
   x-mint.href on every operation, from _project/hrefs.yaml. These are
   public URLs: the build re-derives each one and fails if it has moved,
   because a tag rename changes them silently and links point at them.
 
-prose                            0 written of 453 fields
+prose                            0 written of 462 fields
   Authored in overlays/docs-prose.yaml under the grounding gate and
   merged into openapi.yaml by this script. Every prose field here is
   stripped and reapplied on each build, so nothing reaches the
   published document without passing that gate.
 
-servers                          1 root + 76 path override(s)
+servers                          1 root + 78 path override(s)
   Every URL comes from _project/servers.yaml; which plane a path is on
   comes from _project/planes.yaml. Edit a host there and rebuild. The
   first entry in a plane is the one Mintlify builds its sample from;
@@ -31,6 +31,8 @@ servers                          1 root + 76 path override(s)
       https://api.apps.paloaltonetworks.com/ai_gw/admin/v2  -- Managed
     admin-in-path     4 path(s)
       https://api.apps.paloaltonetworks.com/ai_gw  -- Managed
+    workspace         2 path(s)
+      https://api.sase.paloaltonetworks.com/airs/workspace/v1  -- Managed
 
 security                         1 scheme
   One Authorization bearer token, declared once at the root. Six schemes
@@ -114,7 +116,5 @@ not shipped
     User Invites
     Users
     Virtual Keys
-    Workspaces
-    Workspaces > Members
   parameters, on any operation:
     organisation_id
@@ -565,6 +565,19 @@
             "GET /policies/usage-limits/{policyUsageLimitsId}/entities",
             "PUT /policies/usage-limits/{policyUsageLimitsId}/entities/{entityId}/reset"
           ]
+        },
+        {
+          "group": "Workspaces",
+          "openapi": {
+            "source": "https://raw.githubusercontent.com/PaloAltoNetworks/openapi/refs/heads/main/openapi.yaml",
+            "directory": "api-reference"
+          },
+          "pages": [
+            "GET /workspaces",
+            "POST /workspaces",
+            "GET /workspaces/{id}",
+            "PUT /workspaces/{id}"
+          ]
         }
       ]
     },