Authorization
What a key can read, and the one rule that decides it.
A key is scoped to the workspace that created it. Every list it reads and every record it can open belongs to that workspace; a record in another workspace does not exist as far as the key is concerned, whether it is asked for by list, by id or by search. That scoping is a property of every endpoint, not something an endpoint opts into.
There are no per-key permissions in v1. A key reads what an administrator of the workspace can see in the dashboard, for the resources the API exposes.
Requests are made in the context of the key's workspace, so nothing in the request names a workspace: there is no workspace id to pass and none is accepted.