fleetworks / warden / how-it-works
How a request is checked
Four checks stand between a caller and a record. Each one can only narrow what the next one sees.
- 01
Identity
A person signs in through the shared Fleetworks identity provider and calls with its JWT, verified against the issuer’s keys. A machine calls with a wl_ PAT. The first verified call creates the Warden user.
- 02
Organization and role
Membership in an organization carries one role: org:viewer, org:contributor or org:admin, plus ci:agent for automation. A user with no membership waits until an org admin grants one.
- 03
PAT scope
A PAT can do only what its scopes list, and can be pinned to one resource. A PAT with no scopes is a legacy token: its role governs it, and scope-gated endpoints refuse it.
- 04
Perm mode
Each workspace and service carries a chmod-style mode: view, edit and delete bits for its owner, its group and everyone else. New records default to 770: owner and group can do everything, other callers nothing.
- 05
Validated write
A new workspace must name a service and an AWS account in your organization and a VCS tenant from the catalog, and its workspace_name must be unique.
- 06
Event out
A committed change becomes an event (workspace.created or workspace.updated) delivered to each subscribed webhook endpoint of the same organization.
Roles
Four fixed, ranked levels. A higher role satisfies any check for a lower one; ci:agent is for automation.
- org:viewer
Viewer
Reads the organization’s records.
- org:contributor
Contributor
Reads, and creates and updates workspaces in that organization.
- org:admin
Admin
Everything a contributor can, plus PATs, webhook endpoints, member roles and the content-report queue.
- ci:agent
CI agent
The role for automation callers.
PAT scopes
- workspaces:read
- List and read workspaces
- workspaces:write
- Create and update workspaces
- services:read
- Read services
- accounts:read
- Read AWS and Azure accounts
- webhooks:manage
- Manage webhook endpoints
- tokens:manage
- Manage PATs
What anonymous callers can see
The public subtree (/api/gatehouse/public) needs no sign-in. It returns a workspace or service only when its Perm mode grants view to other callers, and only the public projection: a fixed allowlist of fields such as the workspace name, region, VCS provider, repo and Terraform version.
Webhook payloads use the same public projection, so an event never carries more than an anonymous caller could read.
Bring your Terraform Cloud footprint into one place
Sign in with your Fleetworks account. An org admin grants your role, and your organization’s workspaces are there.