> ## Documentation Index > Fetch the complete documentation index at: https://docs.doers.sh/llms.txt > Use this file to discover all available pages before exploring further. # Open or close the target to everyone in its workspace > The "Everyone in " row: `view` lets whoever sits in the workspace read it, `edit` lets them edit, `none` closes it to all but the people granted. Never reaches anyone outside the workspace. ## OpenAPI ````yaml https://api.doers.sh/openapi.json put /v2/access/{targetKind}/{targetId}/workspace openapi: 3.1.0 info: title: Doers API version: 2.0.0 description: >- The open API of Doers: tasks, projects, areas, prioritised context and the day's plan. ## Authentication Every route requires a bearer token, generated from **Settings > API & MCP** in the app: ``` Authorization: Bearer pc_… ``` ## Two date fields, not to be confused - `when` — the **schedule**: `today`, `anytime` (Later), `someday` (Future) or a date. - `deadline` — the **commitment**, independent of the schedule. ## Time zone The server reasons in UTC and does not know yours. Send the `X-PC-Today: YYYY-MM-DD` header (or the `day` argument where it exists) so dated operations use your local day. ## MCP server The same token gives access to the [Model Context Protocol](https://modelcontextprotocol.io) server at `POST https://doers.sh/mcp`, which exposes the same operations as tools for Claude, Cursor and other compatible clients. servers: - url: https://api.doers.sh description: Production. security: - bearerAuth: [] tags: - name: Tasks - name: Projects - name: Areas - name: Headings - name: Comments - name: Realtime - name: Devices - name: Context - name: Plan - name: Sessions - name: Rounds - name: Journal - name: Habits - name: Stats - name: Users - name: Profiles - name: Workspaces - name: Access - name: Activity - name: Tokens - name: Referrals - name: Files - name: Connections - name: Collaborators - name: Links - name: Packages - name: Installs - name: Billing - name: Calendar - name: Coach - name: Marketplace paths: /v2/access/{targetKind}/{targetId}/workspace: put: tags: - Access summary: Open or close the target to everyone in its workspace description: >- The "Everyone in " row: `view` lets whoever sits in the workspace read it, `edit` lets them edit, `none` closes it to all but the people granted. Never reaches anyone outside the workspace. operationId: setWorkspaceAccess parameters: - name: targetId in: path required: true description: Identifier of a row. schema: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ - name: targetKind in: path required: true description: 'What is shared: a project, or an area and every project in it.' schema: type: string enum: - project - area requestBody: required: true content: application/json: schema: type: object properties: access: type: string enum: - none - view - edit description: >- What everyone in the target's workspace may do with it: nothing, read, or edit. required: - access additionalProperties: false responses: '200': description: Success. content: application/json: schema: type: object properties: access: type: object properties: role: type: string enum: - reader - commenter - editor - owner description: Yours. canManage: type: boolean description: >- The owner, or an owner or admin of the target's workspace, may change who reaches it. owner: type: object properties: id: type: string username: anyOf: - type: string - type: 'null' name: anyOf: - type: string - type: 'null' email: anyOf: - type: string - type: 'null' image: anyOf: - type: string - type: 'null' membershipId: anyOf: - type: string - type: 'null' description: >- The row to patch or delete. `null` for the owner, who has no membership. role: type: string enum: - reader - commenter - editor - owner description: >- Ascending. `owner` is not grantable: it is what owning the task means. required: - id - username - name - email - image - membershipId - role additionalProperties: false people: type: array items: type: object properties: id: type: string username: anyOf: - type: string - type: 'null' name: anyOf: - type: string - type: 'null' email: anyOf: - type: string - type: 'null' image: anyOf: - type: string - type: 'null' accessId: type: string description: The grant to patch or delete. role: type: string enum: - reader - commenter - editor - owner description: >- Ascending. `owner` is not grantable: it is what owning the task means. isGuest: type: boolean description: >- Not seated in the target's workspace: reaches this one thing, at Can comment at most. required: - id - username - name - email - image - accessId - role - isGuest additionalProperties: false invites: type: array items: type: object properties: id: type: string email: type: string role: type: string enum: - reader - commenter - editor - owner description: >- Ascending. `owner` is not grantable: it is what owning the task means. invitePath: type: string description: >- Where to send them. Carries the token, so treat it as one. createdAt: type: number description: Epoch milliseconds. required: - id - email - role - invitePath - createdAt additionalProperties: false description: >- Pending, listed to those who may manage; never with a link. workspace: type: object properties: id: type: string name: type: string access: type: string enum: - none - view - edit description: >- What everyone in the target's workspace may do with it: nothing, read, or edit. plan: type: string enum: - free - pro - team description: >- The workspace owner's plan; Pro never sees the word workspace. required: - id - name - access - plan additionalProperties: false link: anyOf: - type: object properties: id: type: string targetKind: type: string enum: - task - project - area description: What the link points at. targetId: type: string label: type: string description: >- The name of what is shared, as it stands today. email: anyOf: - type: string - type: 'null' createdAt: type: number description: Epoch milliseconds. required: - id - targetKind - targetId - label - email - createdAt additionalProperties: false - type: 'null' description: The public link, when one is on; never its address. taskCount: type: integer minimum: 0 maximum: 9007199254740991 required: - role - canManage - owner - people - invites - workspace - link - taskCount additionalProperties: false required: - access additionalProperties: false '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/TooManyRequests' components: responses: BadRequest: content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Invalid request — unreadable body, out-of-range field or unknown parameter. Unauthorized: content: application/json: schema: $ref: '#/components/schemas/Error' description: Token missing, unknown or revoked. Forbidden: content: application/json: schema: $ref: '#/components/schemas/Error' description: Readable resource, but your role does not permit this action. NotFound: content: application/json: schema: $ref: '#/components/schemas/Error' description: >- Resource does not exist **or** belongs to another account — the API never distinguishes the two. TooManyRequests: content: application/json: schema: $ref: '#/components/schemas/Error' description: Too many requests. `Retry-After` says how many seconds to wait. schemas: Error: type: object properties: error: type: object properties: code: type: string description: Stable machine-readable code. message: type: string description: Human-readable message. details: type: array description: Per-field detail, present on validation errors. items: type: object properties: field: type: string message: type: string required: - field - message required: - code - message required: - error securitySchemes: bearerAuth: type: http scheme: bearer description: A `pc_…` token generated from Settings > API & MCP. ````