> ## Documentation Index > Fetch the complete documentation index at: https://docs.dmly.io/llms.txt > Use this file to discover all available pages before exploring further. # Provision a sub-account workspace. > Creates an owner user plus a workspace under the agency, on the supplied base-plan uuid or the agency's default plan (its limits are copied onto the workspace). name (the owner's name), business_name (becomes the workspace name), email (must be unique across users) and password (min 8) are required; plan is optional and must be a base plan belonging to the agency. Returns 201 with the workspace card plus an `owner` object (`{ name, email }`). Returns 422 if the agency is at its sub-account limit or the plan is not the agency's. ## OpenAPI ````yaml /api-reference/agency-openapi.json post /workspaces openapi: 3.1.0 info: title: DMLY Agency API version: 1.0.0 description: >- The DMLY Agency API lets a whitelabel reseller manage its sub-accounts programmatically — provision customer workspaces, assign plans and add-ons, and subscribe to sub-account lifecycle events. It is a separate surface from the public workspace [REST API](/api-reference/introduction): a different base URL, a different key, and a different set of webhooks. ## Base URL ``` https://dash.dmly.io/api/agency/v1 ``` ## Authentication Every request carries an **agency API key**, which authenticates the acting agency and scopes every request to that agency's own sub-accounts — an agency can only ever see and act on its own workspaces. ``` x-api-key: dmly_ag_xxxxxxxx… ``` `Authorization: Bearer dmly_ag_xxxxxxxx…` is also accepted. Mint and revoke keys from the agency console under **API Keys**. The plaintext key is shown **once** on creation; only its hash is stored. An agency key is different from a workspace API key (`dmly_…`) and is not interchangeable with it. ## Conventions - Sub-accounts, plans, add-ons and webhook endpoints are identified by their public `uuid`, returned as `uuid`. - Lists are paginated with `?per_page` (alias `?limit`) — default 25, hard cap 100. ## Availability The whole surface can be disabled fleet-wide during an incident without revoking individual keys; while it is off, every endpoint returns `503`. contact: name: DMLY url: https://dmly.io servers: - url: https://dash.dmly.io/api/agency/v1 description: DMLY security: - agencyApiKeyAuth: [] - agencyBearerAuth: [] tags: - name: Agency Plans description: Endpoints for Agency Plans. - name: Agency Subscriptions and add-ons description: Endpoints for Agency Subscriptions and add-ons. - name: Agency Webhook endpoints description: Endpoints for Agency Webhook endpoints. - name: Agency Workspaces description: Endpoints for Agency Workspaces. - name: Agency events description: Sub-account lifecycle events DMLY posts to your endpoint. paths: /workspaces: post: tags: - Agency Workspaces summary: Provision a sub-account workspace. description: >- Creates an owner user plus a workspace under the agency, on the supplied base-plan uuid or the agency's default plan (its limits are copied onto the workspace). name (the owner's name), business_name (becomes the workspace name), email (must be unique across users) and password (min 8) are required; plan is optional and must be a base plan belonging to the agency. Returns 201 with the workspace card plus an `owner` object (`{ name, email }`). Returns 422 if the agency is at its sub-account limit or the plan is not the agency's. operationId: workspaces.store.post requestBody: required: true content: application/json: schema: type: object properties: name: type: string business_name: type: string email: type: string format: email password: type: string plan: type: string example: name: Jane Doe business_name: Jane Fitness email: jane@example.com password: supersecret plan: 9b1e4c7a-0000-4000-8000-000000000000 responses: '201': description: Success. '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '422': $ref: '#/components/responses/ValidationError' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/Unavailable' components: responses: Unauthorized: description: The agency API key is missing or invalid. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: This agency has been suspended, so its keys no longer work. content: application/json: schema: $ref: '#/components/schemas/Error' ValidationError: description: Validation failed. content: application/json: schema: $ref: '#/components/schemas/ValidationError' RateLimited: description: >- Rate limit exceeded: 120 requests per minute per agency key. Requests without a valid key share a per-IP budget of 60 per minute instead. headers: Retry-After: description: Seconds until the limit resets. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' Unavailable: description: The reseller API is currently disabled fleet-wide. content: application/json: schema: $ref: '#/components/schemas/Error' schemas: Error: type: object properties: message: type: string ValidationError: type: object properties: message: type: string errors: type: object description: Field name → array of messages. additionalProperties: type: array items: type: string securitySchemes: agencyApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your agency API key (`dmly_ag_…`). It authenticates the acting agency and scopes every request to that agency's own sub-accounts and plans. agencyBearerAuth: type: http scheme: bearer description: 'The same agency API key, sent as `Authorization: Bearer dmly_ag_…`.' ````