Common

Permissions and security

Every request evaluates the user's current workspace and team roles, not a snapshot from when the token was issued.

Permission model

A PAT is personally owned and must not be transferred to another user.
It can only read resources allowed by current workspace and team roles.
There is no separate PAT scope selector or fixed permission snapshot.

Changes apply immediately

1
Role change
The next API request uses the updated permissions.
2
Member deactivation
PATs owned by a deactivated member can no longer access the workspace.
3
Workspace PAT disabled
Requests to that workspace are rejected immediately with HTTP 401 and exactly {"type":"UNAUTHORIZED"}, with no data or reason. This is indistinguishable from an expired or revoked PAT.