> ## Documentation Index > Fetch the complete documentation index at: https://checkfu.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Resolve work-workspace requirements > Compiles explicit provider-neutral requirements or one versioned preset and explains the platform path without allocating, waking, reserving UsageBudget, or contacting a provider. The response returns normalized requirements, the no-compute, SessionSandbox, or Computer class, every considered provider and stable rejection reason, warnings, estimated usage dimensions, portability grade, and manifest-bound digests. Current support resolves conversation-only and existing SessionSandbox intent; Computer intent remains an inspectable refusal until a qualified provider candidate exists. This read authorizes nothing and creation re-evaluates all live authority. Checkfu support posture: alpha; hosted. Required evidence journey: session-turn. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities. ## OpenAPI ````yaml /openapi.json post /v1/work-environments/resolve openapi: 3.1.0 info: title: Checkfu API version: '2026-08-27' description: >- Authentication is declared per operation: API-key, runtime, or connector bearer; Automation signature; or credential-free pairing redemption. Every general Checkfu REST request requires the dated `Checkfu-Version` header (one of: 2026-08-27); the three MCP JSON-RPC transports use `MCP-Protocol-Version`, A2A uses `A2A-Version`, and the provider OAuth callback carries neither Checkfu header. API keys resolve one Workspace without a request selector; authenticated responses identify it with `Checkfu-Workspace-Id`. servers: - url: https://api.checkfu.com security: - bearerAuth: [] tags: - name: organizations - name: sourceRepositories - name: tenants - name: workspaces - name: principals - name: principalGroups - name: principalAccessCredentials - name: apiKeys - name: agents - name: harnesses - name: harnessRuntime - name: sandboxProfiles - name: computerProfiles - name: permissionAssignments - name: actionPolicies - name: files - name: memoryStores - name: dreams - name: modelCredentials - name: modelRoutingProfiles - name: blueprintInstallations - name: toolSources - name: skills - name: skillSources - name: agentSources - name: skillProposals - name: instructionProposals - name: catalog - name: concepts - name: support - name: connections - name: connectionVaults - name: connectionAssignments - name: connectedRuntimes - name: projects - name: collaboration - name: automationGraphs - name: automations - name: actionApprovals - name: standingApprovals - name: usage - name: models - name: outcomes - name: budgets - name: billing - name: sessions - name: audit - name: sessionExports - name: runs - name: runnerPools - name: transcripts - name: sessionWatches - name: webhookEndpoints - name: integrationGateway - name: agentDeployments - name: workEnvironments - name: computers - name: computerScreens - name: computerBrowserObservations - name: computerBrowserActions - name: environments - name: vaults - name: apiMcp - name: a2a paths: /v1/work-environments/resolve: post: tags: - workEnvironments summary: Resolve work-workspace requirements description: >- Compiles explicit provider-neutral requirements or one versioned preset and explains the platform path without allocating, waking, reserving UsageBudget, or contacting a provider. The response returns normalized requirements, the no-compute, SessionSandbox, or Computer class, every considered provider and stable rejection reason, warnings, estimated usage dimensions, portability grade, and manifest-bound digests. Current support resolves conversation-only and existing SessionSandbox intent; Computer intent remains an inspectable refusal until a qualified provider candidate exists. This read authorizes nothing and creation re-evaluates all live authority. Checkfu support posture: alpha; hosted. Required evidence journey: session-turn. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities. operationId: workEnvironments.resolveWorkEnvironment parameters: - name: checkfu-version in: header schema: type: string enum: - '2026-08-27' required: true requestBody: content: application/json: schema: $ref: '#/components/schemas/WorkEnvironmentInput' required: true responses: '200': description: >- A deterministic allocation-free explanation of work-environment admission. content: application/json: schema: $ref: '#/components/schemas/WorkEnvironmentResolution' headers: checkfu-workspace-id: description: The Workspace resolved from the authenticated bearer credential. required: true schema: $ref: '#/components/schemas/WorkspaceId' '400': description: Typed Checkfu wire error content: application/json: schema: $ref: '#/components/schemas/ValidationMalformedError' '401': description: Typed Checkfu wire error content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - auth.invalid_key message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-invalid-key description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '403': description: >- The organization, tenant, or workspace backing this key is administratively disabled. | Deployment governance or retention policy denied the request. content: application/json: schema: anyOf: - type: object required: - error properties: error: type: object properties: type: type: string enum: - auth.disabled_tenancy message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-disabled-tenancy description: >- Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false additionalProperties: false - $ref: '#/components/schemas/PolicyDeniedError' '429': description: Typed Checkfu wire error headers: retry-after: description: >- Delay in seconds for rate limits or deployment quotas with a known release or UTC reset boundary required: false schema: type: integer minimum: 1 content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - budget.exceeded message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#budget-exceeded description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '500': description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. content: application/json: schema: $ref: '#/components/schemas/RuntimeInternalError' security: - bearerAuth: [] components: schemas: WorkEnvironmentInput: anyOf: - type: object properties: input_type: type: string enum: - preset preset: type: string enum: - conversation_only - sandbox_ephemeral - sandbox_durable - browser_isolated - browser_shared_profile - desktop_isolated - desktop_shared_filesystem - connected_computer overrides: type: object properties: execution: $ref: '#/components/schemas/Arrays_17' placement: $ref: '#/components/schemas/Arrays_18' locality: type: object properties: regions: $ref: '#/components/schemas/Arrays_19' residency_required: type: boolean required: - regions - residency_required additionalProperties: false resources: type: object properties: minimum_vcpu: anyOf: - type: integer allOf: - exclusiveMinimum: 0 - maximum: 1024 - type: 'null' minimum_memory_mib: anyOf: - type: integer allOf: - exclusiveMinimum: 0 - maximum: 4194304 - type: 'null' minimum_disk_mib: anyOf: - type: integer allOf: - exclusiveMinimum: 0 - maximum: 1073741824 - type: 'null' gpu: $ref: '#/components/schemas/Union_93' required: - minimum_vcpu - minimum_memory_mib - minimum_disk_mib - gpu additionalProperties: false additionalProperties: false required: - input_type - preset additionalProperties: false - type: object properties: input_type: type: string enum: - requirements requirements: $ref: '#/components/schemas/WorkEnvironmentRequirements' required: - input_type - requirements additionalProperties: false description: >- Explicit requirements or a versioned convenience preset with safe overrides. WorkEnvironmentResolution: type: object properties: disposition: type: string enum: - resolved - refused resolver_version: type: string enum: - work-environment-resolver/v1 preset_catalog_version: type: number enum: - 1 normalized_requirements: $ref: '#/components/schemas/WorkEnvironmentRequirements' resolved_kind: type: string enum: - none - session_sandbox - computer requires_screen: type: boolean forced_by: type: array items: type: string allOf: - minLength: 1 - maxLength: 128 - pattern: ^[a-z_]+(?:\.[a-z_]+)*$ allOf: - maxItems: 16 selected_provider: anyOf: - type: object properties: provider: type: string allOf: - minLength: 1 - maxLength: 128 - pattern: ^[a-z0-9][a-z0-9._-]*$ tuple_digest: type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ evidence_grade: type: string enum: - double - live_qualified required: - provider - tuple_digest - evidence_grade additionalProperties: false - type: 'null' considered: type: array items: type: object properties: provider: type: string allOf: - minLength: 1 - maxLength: 128 - pattern: ^[a-z0-9][a-z0-9._-]*$ tuple_digest: type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ qualified: type: boolean reasons: type: array items: type: object properties: code: type: string enum: - live_qualification_missing - execution_unsupported - lifetime_unsupported - presentation_unsupported - human_access_unsupported - observation_transport_unsafe - exclusive_control_unfenced - placement_unsupported - recovery_unsupported - retention_unsupported - network_unsupported - network_enforcement_unsupported - region_unsupported - resource_insufficient - gpu_unsupported - isolation_unsupported requirement_path: type: string allOf: - minLength: 1 - maxLength: 128 - pattern: ^[a-z_]+(?:\.[a-z_]+)*$ expected: type: string allOf: - minLength: 1 - maxLength: 512 observed: type: string allOf: - minLength: 1 - maxLength: 512 evidence_reference: anyOf: - type: string allOf: - minLength: 1 - maxLength: 512 - type: 'null' required: - code - requirement_path - expected - observed - evidence_reference additionalProperties: false allOf: - maxItems: 32 required: - provider - tuple_digest - qualified - reasons additionalProperties: false allOf: - maxItems: 64 warnings: type: array items: type: object properties: code: anyOf: - type: string enum: - shared_profile_credentials message: type: string allOf: - minLength: 1 - maxLength: 512 acknowledgement_required: type: boolean required: - code - message - acknowledgement_required additionalProperties: false allOf: - maxItems: 16 estimated_usage_dimensions: type: array items: type: string enum: - compute_seconds - screen_seconds - storage_mib_seconds allOf: - maxItems: 3 refusal: anyOf: - $ref: '#/components/schemas/WorkEnvironmentRefusal' - type: 'null' portability: type: string enum: - not_applicable - unproved - single_live_provider - portable candidate_set_digest: type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ resolution_digest: type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ required: - disposition - resolver_version - preset_catalog_version - normalized_requirements - resolved_kind - requires_screen - forced_by - selected_provider - considered - warnings - estimated_usage_dimensions - refusal - portability - candidate_set_digest - resolution_digest additionalProperties: false description: >- A deterministic allocation-free explanation of work-environment admission. WorkspaceId: type: string allOf: - pattern: ^wrkspc_[0-9a-f]{32}$ ValidationMalformedError: type: object properties: error: type: object properties: type: type: string enum: - validation.malformed message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-malformed description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- The request could not be decoded or violated a declared input constraint. PolicyDeniedError: type: object properties: error: type: object properties: type: type: string enum: - policy.denied message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#policy-denied description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: Deployment governance or retention policy denied the request. RuntimeInternalError: type: object properties: error: type: object properties: type: type: string enum: - runtime.internal message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#runtime-internal description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. Arrays_17: type: array items: type: string enum: - shell - filesystem - network_server - browser_dom - browser_visual - desktop_gui allOf: - maxItems: 6 Arrays_18: type: array items: type: string enum: - managed - local - connected allOf: - maxItems: 3 Arrays_19: type: array items: type: string allOf: - minLength: 1 - maxLength: 64 - pattern: ^[a-z0-9][a-z0-9-]*$ allOf: - maxItems: 32 Union_93: type: string enum: - forbidden - optional - required WorkEnvironmentRequirements: type: object properties: schema_version: type: number enum: - 1 execution: $ref: '#/components/schemas/Arrays_17' lifetime: type: string enum: - run - session - durable presentation: type: string enum: - none - browser - desktop human_access: type: string enum: - none - observe - exclusive_takeover placement: $ref: '#/components/schemas/Arrays_18' isolation: type: object properties: filesystem: $ref: '#/components/schemas/Union_91' browser_profile: $ref: '#/components/schemas/Union_91' process_namespace: $ref: '#/components/schemas/Union_91' credentials: type: string enum: - grant_bound - profile_shared clipboard: type: string enum: - disabled - attachment - scope_shared downloads: $ref: '#/components/schemas/Union_91' required: - filesystem - browser_profile - process_namespace - credentials - clipboard - downloads additionalProperties: false recovery: $ref: '#/components/schemas/Union_92' retention: $ref: '#/components/schemas/WorkEnvironmentRetention' network: $ref: '#/components/schemas/WorkEnvironmentNetwork' locality: $ref: '#/components/schemas/WorkEnvironmentLocality' resources: $ref: '#/components/schemas/WorkEnvironmentResources' required: - schema_version - execution - lifetime - presentation - human_access - placement - isolation - recovery - retention - network - locality - resources additionalProperties: false WorkEnvironmentRefusal: type: object properties: code: type: string enum: - human_access_requires_presentation - browser_presentation_requires_browser_visual - desktop_presentation_requires_desktop_gui - browser_recovery_requires_browser - recovery_requires_durable_lifetime - zdr_forbids_shared_credentials - zdr_forbids_export - bounded_retention_requires_maximum - unbounded_retention_forbids_maximum - allowlist_requires_policy_revision - network_policy_revision_not_applicable - residency_requires_region - compute_requires_placement - durable_lifetime_requires_execution - resources_require_execution - shared_isolation_requires_durable_lifetime - override_weakens_preset - provider_candidate_limit_exceeded - duplicate_provider_candidate - no_qualified_provider - authorization_denied - budget_denied requirement_path: type: string allOf: - minLength: 1 - maxLength: 128 - pattern: ^[a-z_]+(?:\.[a-z_]+)*$ message: type: string allOf: - minLength: 1 - maxLength: 512 required: - code - requirement_path - message additionalProperties: false description: A stable, provider-neutral reason a work environment cannot be admitted. Union_91: type: string enum: - attachment - application - scope_shared Union_92: type: string enum: - none - filesystem - browser_profile - full_instance WorkEnvironmentRetention: type: object properties: mode: type: string enum: - ephemeral_zdr - bounded - durable maximum_seconds: anyOf: - type: integer allOf: - exclusiveMinimum: 0 - maximum: 315360000 - type: 'null' export: type: string enum: - forbidden - allowed required: - mode - maximum_seconds - export additionalProperties: false description: >- Retention duration, durability mode, and export policy for a work environment. WorkEnvironmentNetwork: type: object properties: mode: type: string enum: - none - allowlist - unrestricted policy: anyOf: - type: object properties: action_policy_id: $ref: '#/components/schemas/ActionPolicyId' action_policy_version: type: integer allOf: - exclusiveMinimum: 0 required: - action_policy_id - action_policy_version additionalProperties: false - type: 'null' required: - mode - policy additionalProperties: false description: >- Network access mode and optional versioned action policy for a work environment. WorkEnvironmentLocality: type: object properties: regions: $ref: '#/components/schemas/Arrays_19' residency_required: type: boolean required: - regions - residency_required additionalProperties: false description: >- Ordered eligible regions and residency requirement for a work environment. WorkEnvironmentResources: type: object properties: minimum_vcpu: anyOf: - type: integer allOf: - exclusiveMinimum: 0 - maximum: 1024 - type: 'null' minimum_memory_mib: anyOf: - type: integer allOf: - exclusiveMinimum: 0 - maximum: 4194304 - type: 'null' minimum_disk_mib: anyOf: - type: integer allOf: - exclusiveMinimum: 0 - maximum: 1073741824 - type: 'null' gpu: $ref: '#/components/schemas/Union_93' required: - minimum_vcpu - minimum_memory_mib - minimum_disk_mib - gpu additionalProperties: false description: >- Minimum compute, memory, disk, and GPU requirements for a work environment. ActionPolicyId: type: string allOf: - pattern: ^apol_[0-9a-f]{32}$ securitySchemes: bearerAuth: type: http scheme: bearer ````