Skip to main content

​
not_found

We deliberately collapse “doesn’t exist” and “exists but you can’t see it” into a single 404 so that attackers cannot enumerate which resource ids exist outside their workspace by replaying ids and looking for 401/403/404 differences. This means a 404 can mean any of:
  • The id doesn’t exist at all.
  • The id is malformed (wrong prefix, e.g. you sent a note_* to /v1/posts/).
  • The id exists but belongs to a different workspace than the one your API key authenticates.
  • The id exists but its parent project is archived/deleted, so the resource is no longer reachable.
To recover, double-check that:
  1. The id has the right prefix for the endpoint (note_ for notes, post_ for posts, proj_ for projects, src_ for sources).
  2. You’ve copied the full id, including the prefix.
  3. The id was created inside the workspace whose API key you’re using.
If you genuinely need to confirm whether a resource exists in a different workspace, you’ll need a key for that workspace. There is no cross-workspace introspection.