Create a meet workspace

Create a meet workspace — the parent resource that holds your SAML cert + private key for one Google Workspace's SSO config.

A meet workspace represents one Google Workspace whose Legacy SSO profile points at our /v2/meet-sso/* endpoints. The cert and key on the workspace are shared by every meet_login (Workspace user identity) you attach to it, mirroring how Google Workspace stores a single verification certificate per SSO profile.

Two creation paths, same response shape:

• Server-generated keypair — pass generate_keypair: true. The server creates a self-signed RSA-2048 keypair with 10-year validity. Use this if you don't already have a SAML cert and want the simplest setup.
• Bring-your-own keypair — pass cert_pem and private_key_pem together. Use this if you want to manage your own crypto or already have a cert/key pair you trust.

Mutually exclusive: provide either generate_keypair: true OR (cert_pem + private_key_pem), not both.

Response always includes cert_pem so you can upload it to Google's Legacy SSO profile in your Workspace admin console. private_key_pem is never returned.

After creation, you must:

1. Upload the returned cert_pem to Google Admin Console → Security → Set up SSO with third-party IdP → Legacy SSO profile.
2. Set Sign-in URL to https://api.meetingbaas.com/v2/meet-sso/sign-in and Sign-out URL to https://api.meetingbaas.com/v2/meet-sso/sign-out in the same SSO profile. Enable "Use a domain-specific issuer" and assign the SSO profile to all users.
3. Create one or more Workspace users that bots will sign in as, complete the "Welcome to Workspace" interactive login for each, and set language to "English (United States)".
4. Add meet_logins (one per Workspace user) referencing this workspace_id.
5. Optionally call POST /v2/meet-workspaces/:workspace_id/verify to run pre-flight checks.

Security: The cert and key are encrypted at rest using AES-256-GCM. private_key_pem is never echoed in any response — including subsequent GETs. If you need it back, you must rotate via PATCH.

Per-team uniqueness: Each domain may exist at most once per team. Attempting to create a duplicate returns 409.

Error Scenarios:

• 409 Conflict: A workspace for this domain already exists.
• 422 Unprocessable Entity: Invalid cert/key (parse failure or modulus mismatch); both generate_keypair and cert_pem provided; neither provided.

curl -X POST "https://api.meetingbaas.com/v2/meet-workspaces" \  -H "Content-Type: application/json" \  -d '{    "domain": "bots.acme.com"  }'

{
  "data": {
    "cert_pem": "string",
    "created_at": "string",
    "domain": "string",
    "extra": {
      "environment": "production",
      "tenant_id": "t_123"
    },
    "failure_data": null,
    "last_error_at": "string",
    "last_error_message": "string",
    "name": "string",
    "state": "active",
    "updated_at": "string",
    "workspace_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
  },
  "success": true
}

{
  "code": "string",
  "error": "string",
  "message": "string",
  "statusCode": 9007199254740991,
  "success": false
}

{
  "code": "string",
  "details": "string",
  "error": "string",
  "message": "string",
  "statusCode": 9007199254740991,
  "success": false
}

{
  "code": "string",
  "details": "string",
  "error": "string",
  "message": "string",
  "retryAfter": 9007199254740991,
  "statusCode": 9007199254740991,
  "success": false
}

{
  "code": "string",
  "details": "string",
  "error": "string",
  "message": "string",
  "statusCode": 9007199254740991,
  "success": false
}