> ## Documentation Index
> Fetch the complete documentation index at: https://namespace.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

Namespace uses a resource-based permission model. Each API action is associated with a resource type
and optionally scoped to a specific resource ID.

The following lists all public resources and their available actions.

# Public Resources

The following resources and actions are publicly available in the Namespace API.

## artifact

Objects stored in a workspace, identified by a path and namespace.

| action    | description                             |
| --------- | --------------------------------------- |
| `create`  | Upload a new artifact to the workspace. |
| `expire`  | Mark an artifact for deletion.          |
| `list`    | List artifacts in the workspace.        |
| `resolve` | Download or retrieve an artifact.       |

## bazel

### bazel/cache

Managed Bazel remote cache for accelerating builds by storing and retrieving build artifacts.

| action   | description                                            |
| -------- | ------------------------------------------------------ |
| `ensure` | Provision cache instance and get endpoint credentials. |

### bazel/execution

Managed Bazel remote execution (RBE) clusters for running build and test actions remotely.

| action   | description                                                      |
| -------- | ---------------------------------------------------------------- |
| `ensure` | Provision execution cluster and get scheduler/storage endpoints. |
| `get`    | Get an existing execution cluster's endpoints.                   |

## builder

Remote BuildKit instances that perform container image builds on behalf of a workspace.

| action   | description                            |
| -------- | -------------------------------------- |
| `access` | Connect to a running builder instance. |
| `ensure` | Provision or reuse a builder instance. |

## cache

### cache/gradle

Managed Gradle build cache for storing and retrieving build outputs.

| action   | description                                       |
| -------- | ------------------------------------------------- |
| `ensure` | Set up and get Gradle cache endpoint credentials. |
| `read`   | Retrieve artifacts from the Gradle cache.         |
| `write`  | Store artifacts in the Gradle cache.              |

### cache/httpcache

Managed HTTP build cache, compatible with Bazel, sccache, and other HTTP-cache-compatible tools.

| action   | description                                     |
| -------- | ----------------------------------------------- |
| `ensure` | Set up and get HTTP cache endpoint credentials. |
| `read`   | Retrieve artifacts from the HTTP cache.         |
| `write`  | Store artifacts in the HTTP cache.              |

### cache/turborepo

Managed Turborepo remote cache for storing and retrieving task-level build artifacts.

| action   | description                                      |
| -------- | ------------------------------------------------ |
| `delete` | Delete all cached artifacts for a team.          |
| `list`   | List teams with cached artifacts.                |
| `read`   | Retrieve cached artifacts or check cache status. |
| `report` | Submit Turborepo analytics and build events.     |
| `write`  | Store artifacts in the Turborepo cache.          |

## containerregistry

Registry-wide configuration, including default and per-repository image expiration policies.

| action      | description                          |
| ----------- | ------------------------------------ |
| `configure` | Manage registry expiration policies. |

### containerregistry/domain

Custom registry domains that grant read-only image pull access.

| action | description                                   |
| ------ | --------------------------------------------- |
| `pull` | Pull images through a custom registry domain. |

### containerregistry/image

Individual container images within a repository, identified by digest.

| action   | description                                |
| -------- | ------------------------------------------ |
| `delete` | Delete a container image by digest.        |
| `get`    | Get container image details.               |
| `list`   | List container images across repositories. |
| `update` | Update an image's expiration lifetime.     |

### containerregistry/repository

Named image repositories within the container registry.

| action    | description                                    |
| --------- | ---------------------------------------------- |
| `delete`  | Delete a repository and its contents.          |
| `list`    | List image repositories in the registry.       |
| `pull`    | Pull images from a repository.                 |
| `share`   | Create a publicly accessible link to an image. |
| `unshare` | Revoke public access to a shared image.        |

### containerregistry/tags

Tags and tag version history within a repository.

| action | description                |
| ------ | -------------------------- |
| `list` | List tags in a repository. |

## devbox

| action     | description                              |
| ---------- | ---------------------------------------- |
| `activate` | Start or resume a devbox session.        |
| `create`   | Create a new devbox.                     |
| `expire`   | Delete a devbox.                         |
| `fetch`    | Retrieve devbox details.                 |
| `list`     | List devboxes in the workspace.          |
| `update`   | Update devbox metadata or configuration. |

### devbox/image

| action   | description                          |
| -------- | ------------------------------------ |
| `expire` | Delete or expire a devbox image.     |
| `fetch`  | Retrieve devbox image details.       |
| `list`   | List devbox images in the workspace. |
| `wire`   | Resolve a devbox image for use.      |

## github

### github/runner-profile

Configuration profiles for ephemeral GitHub Actions runners, defining instance shape, OS, cache volumes, and custom runner images.

| action   | description                         |
| -------- | ----------------------------------- |
| `create` | Create a new runner profile.        |
| `delete` | Delete a runner profile.            |
| `get`    | Retrieve a specific runner profile. |
| `list`   | List all runner profiles.           |
| `update` | Update a runner profile.            |

## ingress

Authenticated network access to an instance's exposed ports.

| action   | description                         |
| -------- | ----------------------------------- |
| `access` | Access an instance's exposed ports. |

## instance

Ephemeral compute environments for running containers, with support for Docker, Kubernetes, suspend/resume, and remote access.

| action      | description                                |
| ----------- | ------------------------------------------ |
| `create`    | Create a new instance.                     |
| `destroy`   | Permanently terminate an instance.         |
| `dial_host` | Connect to an instance's host services.    |
| `exec`      | Execute a command inside an instance.      |
| `get`       | Retrieve an instance's details.            |
| `list`      | List all instances in the workspace.       |
| `refresh`   | Extend an instance's lifetime deadline.    |
| `release`   | Detach an instance from its unique tag.    |
| `resume`    | Wake a suspended instance.                 |
| `ssh`       | Start an SSH session to an instance.       |
| `suspend`   | Pause an instance, snapshotting its state. |
| `wait`      | Wait for an instance to become ready.      |

### instance/ingress

Public internet ingress endpoints exposed from an instance.

| action     | description                                        |
| ---------- | -------------------------------------------------- |
| `list`     | List ingress endpoints for an instance.            |
| `register` | Expose a backend from an instance to the internet. |

### instance/notification

Lifecycle events representing instance status changes, such as running, terminated, or failed.

| action | description                                 |
| ------ | ------------------------------------------- |
| `list` | List recent lifecycle events for instances. |

### instance/o11y/egress

Egress requests observed from instance(s).

| action | description                                      |
| ------ | ------------------------------------------------ |
| `list` | List egress records (per-instance or aggregated) |

### instance/o11y/logs

Streaming and historical log access for instance workloads.

| action | description                            |
| ------ | -------------------------------------- |
| `get`  | Stream or fetch logs from an instance. |

### instance/o11y/metrics

Time-series resource usage metrics for instances, including CPU, memory, I/O, and storage.

| action | description                                      |
| ------ | ------------------------------------------------ |
| `get`  | Retrieve resource usage metrics for an instance. |

### instance/o11y/oom

Out-of-memory (OOM) kill events detected within an instance.

| action | description                           |
| ------ | ------------------------------------- |
| `list` | List OOM kill events for an instance. |

## network

### network/fabric/segment

Isolated network segments enabling private connectivity between instances.

| action   | description                           |
| -------- | ------------------------------------- |
| `attach` | Connect to a private network segment. |

## tenant

Workspaces in the Namespace platform.

| action | description                                   |
| ------ | --------------------------------------------- |
| `get`  | Retrieve workspace details and configuration. |

<h3 id="tenantbuilder_config">
  tenant/builder\_config
</h3>

Builder configuration for a workspace, including default and per-platform build instance types.

| action   | description                               |
| -------- | ----------------------------------------- |
| `get`    | Retrieve workspace builder configuration. |
| `update` | Update workspace builder configuration.   |

### tenant/policies

Policy configuration for a workspace, including compute quotas and feature flags.

| action | description                                    |
| ------ | ---------------------------------------------- |
| `get`  | Retrieve workspace policy settings and quotas. |

### tenant/usage

Compute and storage resource usage tracking for a workspace.

| action | description                             |
| ------ | --------------------------------------- |
| `get`  | Retrieve usage summary for a workspace. |

## testing

### testing/test/logs

Streaming access to test execution logs for a specific test target.

| action   | description                              |
| -------- | ---------------------------------------- |
| `stream` | Stream logs for a test target execution. |

### testing/test/result

Individual test target results within a test run, including pass/fail status and duration.

| action | description                       |
| ------ | --------------------------------- |
| `list` | List test results within a run.   |
| `push` | Submit test results for a target. |

### testing/test/run

Top-level test execution sessions that group individual test results.

| action     | description                     |
| ---------- | ------------------------------- |
| `complete` | Mark a test run as finished.    |
| `create`   | Start a new test run.           |
| `get`      | Retrieve details of a test run. |
| `list`     | List test runs.                 |

## token

### token/revokable

Long-lived, explicitly revokable access tokens scoped to a workspace, with a maximum lifetime of 1 year.

| action    | description                                                     |
| --------- | --------------------------------------------------------------- |
| `create`  | Create a new revokable access token.                            |
| `list`    | List revokable tokens for a workspace.                          |
| `refresh` | Ensure a token remains valid for at least a requested duration. |
| `revoke`  | Revoke a token to prevent further use.                          |

## vault

### vault/object

Encrypted secret values stored in a workspace's vault, managed via the Vault API.

| action     | description                                             |
| ---------- | ------------------------------------------------------- |
| `create`   | Create a new vault object.                              |
| `delete`   | Delete a vault object.                                  |
| `describe` | Retrieve a vault object's metadata and decrypted value. |
| `list`     | List vault objects in the workspace.                    |
| `update`   | Add a new version to an existing vault object.          |

## volume

Cache volumes (and their snapshot generations) used to persist and reuse data across instances and builds.

| action | description                                                                    |
| ------ | ------------------------------------------------------------------------------ |
| `get`  | Retrieve details for a cache volume, including destroyed snapshot generations. |
| `list` | List cache volumes and their tag summaries.                                    |

### volume/persistent

Persistent volumes that preserve data independently of instance lifecycles.

| action     | description                               |
| ---------- | ----------------------------------------- |
| `describe` | Retrieve persistent volume details.       |
| `destroy`  | Destroy persistent volumes by ID or tag.  |
| `list`     | List persistent volumes in the workspace. |