Workspaces, roles & security
The API never reaches further than you could in the app – and usually much less. Every request is checked again, from scratch, against the current state of your account. Nothing is cached, so a change in the app counts at once.
Every request is checked#
A request to /workspaces/{workspaceId}/… only goes through if all of these hold:
- The key exists, isn't revoked and hasn't expired.
- The account behind it has Pro or Premium right now.
- The key has the scope the endpoint needs.
- The workspace is one of the workspaces chosen for this key.
- You are still a member of it, with the role owner or admin.
- For shared workspaces: it is within your plan's number of API workspaces.
A workspace that isn't part of your key answers 404 workspace_not_found – the same as one that doesn't exist – so a key can't be used to find out about other workspaces. IDs of appointments, documents and so on only resolve inside the workspace in the path.
Who may use the API#
Only owners and admins of a workspace. Adults, children and guests can't use the API for it, even with a Pro or Premium plan of their own. Your personal space is always yours.
If an admin is made a regular member, or leaves, their keys lose that workspace immediately.
Plans#
| Plan | API & MCP | Workspaces per account |
|---|---|---|
| Free, Plus | – | – |
| Pro | ✓ | personal space + 1 shared workspace |
| Premium | ✓ | personal space + 5 shared workspaces |
The shared workspaces are counted across all your keys: two keys for the same workspace count once. The plan of the key's owner counts – not the plan of the workspace owner. AI features in a workspace (butler, document analysis) still use the workspace owner's credits, exactly like in the app.
After a downgrade keys keep working for as many shared workspaces as the new plan allows – the ones you added first. The others answer 403 workspace_limit until you upgrade again or remove a workspace from a key. On Free or Plus every request answers 403 plan_required.
What other members see#
When you connect a shared workspace, every member sees it in the workspace settings: "Connected to other apps through the LifeButler API by: Anna". Things an integration adds show up in the activity feed marked via API. Members can always read the workspace's data in the app anyway; the notice tells them that an app may also act on it on your behalf.
What the API does not reach#
- The family vault – it is end-to-end encrypted on your devices; the server can't read it.
- Health records, profiles, contracts, bills, expenses and member fees have no endpoints (yet).
- Other members' private things: personal spaces of others, their butler conversations, their Telegram/WhatsApp inbox.
- Account, billing and membership changes (invite, remove, roles) – those stay in the app.
The butler answers from what you, as owner or admin, can see in the app – same as asking it there.
Where your data goes#
The API runs in Frankfurt (Google Cloud europe-west3), like the rest of LifeButler. AI features use models hosted in the EU. Each request is logged (time, key id, endpoint, workspace, result – no request contents) for security and support, and these logs are deleted after 30 days. What you do with the data in your own tools is your responsibility – please respect the privacy of the other members of a shared workspace.