The caller's chosen workspace (empty object when never chosen)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.