---
title: "Create Organization"
method: POST
path: "/organizations"
tags: ["Organization"]
---

# Create Organization

`POST /organizations`

Used to create new organizations

## Request body

- Organization
  - `id` string — The ID of the organization
  - `cloud_safe_id` string — Cloud safe ID representation (e.g. GCP and Kubernetes safe)
  - `created_time` integer — Time at which the organization was created
  - `created_by_id` string — The ID of the user who created this organization
  - `resource_bucket_name` string — Input/output artifact bucket. Null if not yet created.
  - `last_updated_time` integer — Time at which the organization was last updated
  - `last_updated_by_id` string — The ID of the user who last updated this organization
  - `name` string — The display name of the organization
  - `account_id` string — The id of the account this organization is in
  - `tags` Tag[] — Free text tags associated with this entity
    - `name` string, required — tag name
    - `values` string[]
  - `support_access_config` WorkspaceSupportAccess
    - `created_time` integer — created time, epoch millis
    - `created_by_id` string — created by user id
    - `last_updated_time` integer — last updated time, epoch millis
    - `last_updated_by_id` string — last update by user id
    - `enable_support_access` boolean, required — Enables support access to workspace
  - `link_access_config` WorkspaceLinkAccessConfig — Consent settings governing who may reach a Link (mablnet) tunnel owned by this workspace or company. Deliberately separate from support_access_config: not all of this has anything to do with support, and reaching a customer's network is a distinct decision from seeing their workspace. This is the set an owner of either kind carries. A workspace additionally carries enable_personal_tunnels — see WorkspaceLinkAccessConfig, which extends this. That flag is meaningless for a company: a personal tunnel belongs to a user, and both halves of the decision it governs are asked of a workspace. Everything here is opt-in. An absent config, and an absent setting within a present config, both admit nobody; only new trial workspaces are created with anything enabled. None of this affects api-key access to a tunnel — an `execution` key reaching a tunnel for a cloud test run is unaffected throughout.
    - `created_time` integer — created time, epoch millis
    - `created_by_id` string — created by user id
    - `last_updated_time` integer — last updated time, epoch millis
    - `last_updated_by_id` string — last update by user id
    - `enable_link_access_by_support` boolean — When true, a mabl support admin may reach the tunnel's published services, such as the SOCKS proxy and reachability probes. When false they may still reach the tunnel's control plane — draining a host, inspecting carriers — which is never gated, but no traffic-carrying service.
    - `member_access_roles` LinkAccessRoleEnum[] — Which member roles may reach the tunnel's published services with their own credentials — the tunnel's audience. A caller is admitted when they hold at least one role named here, so holding a role is necessary and never sufficient: the owner has to have named it. An empty array admits nobody, which is where every owner starts, and leaves only api keys — cloud execution is unaffected. Absent and empty both admit nobody; the difference is about the PATCH, not about access. A PATCH omitting this field leaves the audience as it is, and one sending an empty array clears it.
    - `enable_personal_tunnels` boolean — When true, members of this workspace may start personal tunnels, and this workspace may route cloud test traffic to one. A user may start a personal tunnel if any workspace they belong to allows it, since no single workspace owns it; but only a workspace that allows them may send its runs through one.
  - `onboarded` boolean — flag indicating whether the organization has gone through onboarding
  - `allocations` BillingAllocations — Allocations for the billing period
    - `credits` integer — Total number of credits allocated for the billing period
    - `automators` integer — Total number of automators allocated for the billing period
    - `participants` integer — Total number of participants allocated for the billing period
    - `enforce_limit` boolean, nullable — When true on a workspace's allocations, the workspace's explicit credit allocation is enforced: new cloud runs are blocked once the allocation is exhausted for the billing period. Absent or false, the allocation is informational only. Requires an explicit credits value. Only meaningful on a workspace's allocations; ignored on an account subscription's allocations.
  - `allocated_test_runs` integer — Legacy billing accounts only -- The number of test runs allocated to this workspace
  - `allocated_api_runs` integer — Legacy billing accounts only -- The number of API test runs allocated to this workspace
  - `allocated_a11y_runs` integer — Legacy billing accounts only -- The number of a11y step runs allocated to this workspace
  - `labs_features` string[] — Set of labs features activated for this workspace
  - `excluded_features` string[] — Set of features to exclude from this workspace, overriding account-level grants. When a feature appears here, authorization checks against this workspace will deny it even if the parent account has the feature enabled. Admin-only field.
  - `execution_runner_size` 'x1' | 'x2' | 'x3' | 'x4' | 'x5' | 'x6' | 'small' | 'medium' | 'large' | 'inherit' — available runner sizes
  - `generated_artifact_locale` string — The workspace's locale used to create new artifacts (e.g. test failure summaries, element descriptions). Default is 'en'.
  - `test_recovery_agent_mode` 'off' | 'fail_at_end' | 'pass' | 'inherit' — Test Recovery Agent mode. Use `inherit` (plan-level only) to defer to the workspace-level default.
  - `auto_assign_failure_reason_enabled` boolean — When true, agent-generated failure analysis assigns its suggested failure reason to the test run automatically. When false, the suggested failure reason is still persisted but is not assigned. New workspaces enable this by default. Manual assignments always take precedence.
  - `require_agent_edits_on_branches` boolean — When true, agents must save new tests and edits to a branch rather than the main branch. Owner-editable; behind the agentic_test_editing feature flag.
  - `recovery_agent_auto_edits` boolean — When true, the recovery agent automatically kicks off test edits when it identifies a fix. Owner-editable; behind the agentic_test_editing feature flag.
  - `require_cloud_only_credentials` boolean — When true, credentials created in this workspace must be cloud credentials, whose secrets can never be read back. Enforced on create for every caller, including API keys, rather than left to whoever creates the credential. Existing non-cloud credentials are unaffected and stay editable. Owner-editable.
  - `effective_credit_allocation` integer — Computed effective credit allocation for this workspace. Equals allocations.credits if explicitly set, otherwise the workspace's equal share of remaining account credits.

## Response `201`

The organization that was created

- Organization
  - `id` string — The ID of the organization
  - `cloud_safe_id` string — Cloud safe ID representation (e.g. GCP and Kubernetes safe)
  - `created_time` integer — Time at which the organization was created
  - `created_by_id` string — The ID of the user who created this organization
  - `resource_bucket_name` string — Input/output artifact bucket. Null if not yet created.
  - `last_updated_time` integer — Time at which the organization was last updated
  - `last_updated_by_id` string — The ID of the user who last updated this organization
  - `name` string — The display name of the organization
  - `account_id` string — The id of the account this organization is in
  - `tags` Tag[] — Free text tags associated with this entity
    - `name` string, required — tag name
    - `values` string[]
  - `support_access_config` WorkspaceSupportAccess
    - `created_time` integer — created time, epoch millis
    - `created_by_id` string — created by user id
    - `last_updated_time` integer — last updated time, epoch millis
    - `last_updated_by_id` string — last update by user id
    - `enable_support_access` boolean, required — Enables support access to workspace
  - `link_access_config` WorkspaceLinkAccessConfig — Consent settings governing who may reach a Link (mablnet) tunnel owned by this workspace or company. Deliberately separate from support_access_config: not all of this has anything to do with support, and reaching a customer's network is a distinct decision from seeing their workspace. This is the set an owner of either kind carries. A workspace additionally carries enable_personal_tunnels — see WorkspaceLinkAccessConfig, which extends this. That flag is meaningless for a company: a personal tunnel belongs to a user, and both halves of the decision it governs are asked of a workspace. Everything here is opt-in. An absent config, and an absent setting within a present config, both admit nobody; only new trial workspaces are created with anything enabled. None of this affects api-key access to a tunnel — an `execution` key reaching a tunnel for a cloud test run is unaffected throughout.
    - `created_time` integer — created time, epoch millis
    - `created_by_id` string — created by user id
    - `last_updated_time` integer — last updated time, epoch millis
    - `last_updated_by_id` string — last update by user id
    - `enable_link_access_by_support` boolean — When true, a mabl support admin may reach the tunnel's published services, such as the SOCKS proxy and reachability probes. When false they may still reach the tunnel's control plane — draining a host, inspecting carriers — which is never gated, but no traffic-carrying service.
    - `member_access_roles` LinkAccessRoleEnum[] — Which member roles may reach the tunnel's published services with their own credentials — the tunnel's audience. A caller is admitted when they hold at least one role named here, so holding a role is necessary and never sufficient: the owner has to have named it. An empty array admits nobody, which is where every owner starts, and leaves only api keys — cloud execution is unaffected. Absent and empty both admit nobody; the difference is about the PATCH, not about access. A PATCH omitting this field leaves the audience as it is, and one sending an empty array clears it.
    - `enable_personal_tunnels` boolean — When true, members of this workspace may start personal tunnels, and this workspace may route cloud test traffic to one. A user may start a personal tunnel if any workspace they belong to allows it, since no single workspace owns it; but only a workspace that allows them may send its runs through one.
  - `onboarded` boolean — flag indicating whether the organization has gone through onboarding
  - `allocations` BillingAllocations — Allocations for the billing period
    - `credits` integer — Total number of credits allocated for the billing period
    - `automators` integer — Total number of automators allocated for the billing period
    - `participants` integer — Total number of participants allocated for the billing period
    - `enforce_limit` boolean, nullable — When true on a workspace's allocations, the workspace's explicit credit allocation is enforced: new cloud runs are blocked once the allocation is exhausted for the billing period. Absent or false, the allocation is informational only. Requires an explicit credits value. Only meaningful on a workspace's allocations; ignored on an account subscription's allocations.
  - `allocated_test_runs` integer — Legacy billing accounts only -- The number of test runs allocated to this workspace
  - `allocated_api_runs` integer — Legacy billing accounts only -- The number of API test runs allocated to this workspace
  - `allocated_a11y_runs` integer — Legacy billing accounts only -- The number of a11y step runs allocated to this workspace
  - `labs_features` string[] — Set of labs features activated for this workspace
  - `excluded_features` string[] — Set of features to exclude from this workspace, overriding account-level grants. When a feature appears here, authorization checks against this workspace will deny it even if the parent account has the feature enabled. Admin-only field.
  - `execution_runner_size` 'x1' | 'x2' | 'x3' | 'x4' | 'x5' | 'x6' | 'small' | 'medium' | 'large' | 'inherit' — available runner sizes
  - `generated_artifact_locale` string — The workspace's locale used to create new artifacts (e.g. test failure summaries, element descriptions). Default is 'en'.
  - `test_recovery_agent_mode` 'off' | 'fail_at_end' | 'pass' | 'inherit' — Test Recovery Agent mode. Use `inherit` (plan-level only) to defer to the workspace-level default.
  - `auto_assign_failure_reason_enabled` boolean — When true, agent-generated failure analysis assigns its suggested failure reason to the test run automatically. When false, the suggested failure reason is still persisted but is not assigned. New workspaces enable this by default. Manual assignments always take precedence.
  - `require_agent_edits_on_branches` boolean — When true, agents must save new tests and edits to a branch rather than the main branch. Owner-editable; behind the agentic_test_editing feature flag.
  - `recovery_agent_auto_edits` boolean — When true, the recovery agent automatically kicks off test edits when it identifies a fix. Owner-editable; behind the agentic_test_editing feature flag.
  - `require_cloud_only_credentials` boolean — When true, credentials created in this workspace must be cloud credentials, whose secrets can never be read back. Enforced on create for every caller, including API keys, rather than left to whoever creates the credential. Existing non-cloud credentials are unaffected and stay editable. Owner-editable.
  - `effective_credit_allocation` integer — Computed effective credit allocation for this workspace. Equals allocations.credits if explicitly set, otherwise the workspace's equal share of remaining account credits.

## Other responses

- `400` — Invalid or missing parameter
- `401` — User not authenticated
- `403` — User not authorized
- `default` — Unknown error

---

[API](https://skmtc.net/mabl/apis/mabl-api.md) · [All operations](https://skmtc.net/mabl/apis/mabl-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mabl/mabl-api/revisions/d0fc0114da66/schema)