Skip to main content
Every resource in Ontora — campaigns, transcripts, webhooks, API keys — belongs to a single workspace. Workspaces map 1:1 to Clerk organizations.

​
Membership

Users are added to workspaces through Clerk. Roles: API keys do not have a role — they have scopes (see Authentication). Scope checks replace role checks for programmatic access.

​
Listing your workspaces

Returns the workspaces the current user belongs to. Requires a Clerk JWT (not an API key).

​
Workspace isolation

By default there is no cross-workspace data access. Every API request, every webhook delivery, and every MCP tool call is scoped to a single workspace, derived from:
  • The Clerk organization on the JWT, or
  • The workspace bound to the API key at creation time.
Attempts to read or write data in a different workspace return 403 Forbidden.

​
Linked workspaces

A workspace can be created as a sub-workspace of a main workspace, forming a workspace family. Two things cross workspace boundaries within a family — nothing else does:
  • Campaign sharing — an admin can offer read-only access to a campaign to another workspace in the same family; the recipient workspace must accept the share before anything is visible. API keys always remain scoped to the exact owning workspace.
  • Billing — the family shares one plan. A subscription anywhere in the family entitles every workspace in it, and sub-workspaces without their own billing configuration inherit the main workspace’s.