# Workspaces, roles & security

> Which data a key can reach, who may use the API, plan limits, and what other members see.

The API never reaches further than you could in the app – and usually much less. Every request is checked again, from scratch, against the current state of your account. Nothing is cached, so a change in the app counts at once.

## Every request is checked

A request to `/workspaces/{workspaceId}/…` only goes through if **all** of these hold:

1. The key exists, isn't revoked and hasn't expired.
2. The account behind it has **Pro or Premium** right now.
3. The key has the **scope** the endpoint needs.
4. The workspace is **one of the workspaces chosen for this key**.
5. You are still a **member** of it, with the role **owner or admin**.
6. For shared workspaces: it is within your plan's **number of API workspaces**.

A workspace that isn't part of your key answers `404 workspace_not_found` – the same as one that doesn't exist – so a key can't be used to find out about other workspaces. IDs of appointments, documents and so on only resolve inside the workspace in the path.

## Who may use the API

Only **owners and admins** of a workspace. Adults, children and guests can't use the API for it, even with a Pro or Premium plan of their own. Your personal space is always yours.

If an admin is made a regular member, or leaves, their keys lose that workspace immediately.

## Plans

| Plan | API & MCP | Workspaces per account |
|---|---|---|
| Free, Plus | – | – |
| **Pro** | ✓ | personal space + **1** shared workspace |
| **Premium** | ✓ | personal space + **5** shared workspaces |

The shared workspaces are counted across all your keys: two keys for the same workspace count once. The plan of the **key's owner** counts – not the plan of the workspace owner. AI features in a workspace (butler, document analysis) still use the **workspace owner's** credits, exactly like in the app.

**After a downgrade** keys keep working for as many shared workspaces as the new plan allows – the ones you added first. The others answer `403 workspace_limit` until you upgrade again or remove a workspace from a key. On Free or Plus every request answers `403 plan_required`.

## What other members see

When you connect a shared workspace, **every member** sees it in the workspace settings: *"Connected to other apps through the LifeButler API by: Anna"*. Things an integration adds show up in the activity feed marked *via API*. Members can always read the workspace's data in the app anyway; the notice tells them that an app may also act on it on your behalf.

## What the API does not reach

- The **family vault** – it is end-to-end encrypted on your devices; the server can't read it.
- **Health records**, profiles, contracts, bills, expenses and member fees have no endpoints (yet).
- Other members' private things: personal spaces of others, their butler conversations, their Telegram/WhatsApp inbox.
- Account, billing and membership changes (invite, remove, roles) – those stay in the app.

The **butler** answers from what you, as owner or admin, can see in the app – same as asking it there.

## Where your data goes

The API runs in Frankfurt (Google Cloud `europe-west3`), like the rest of LifeButler. AI features use models hosted in the EU. Each request is logged (time, key id, endpoint, workspace, result – no request contents) for security and support, and these logs are deleted after 30 days. What you do with the data in your own tools is your responsibility – please respect the privacy of the other members of a shared workspace.