Per-workspace API sync
Per-workspace opt-out of Polycrate API coupling in workspace.poly: config.api.enabled: false stops validate, action runs, template publish and CLI audit, but not age encryption.
A workspace can locally disable coupling to the Polycrate API without changing the global CLI config. Use this for scratch, temp, or fork workspaces that must not fire templates, action runs, or validate lookups against the production API.
Field
# workspace.poly
config:
api:
enabled: false
enabled is optional (*bool):
| Value | Effect |
|---|---|
| Field omitted | No veto. The global CLI config applies (api.enabled + api_key in ~/.polycrate/polycrate.yml). |
false |
This workspace does not talk to the API for sync, publish, or audit. |
true |
Follows the global config. Does not force-enable an API that is globally disabled. |
There is no CLI flag for this veto. The override lives only in workspace.poly.
What the veto disables
When config.api.enabled: false:
- Validate-on-load (
ValidateWithAPI) - Action-run submit
- Template publish after
polycrate blocks push - CLI activity audit (SSH session,
workspace sync/git sync)
On a skipped template publish the CLI logs (English): Skipping API template publish: workspace.config.api.enabled is false.
The OCI push to the registry still runs. The field does not delete an already published template or image.
What the veto does not disable
Age encryption (polycrate workspace encrypt / decrypt) may still use the API for the workspace encryption key. The opt-out covers workspace sync, not key material.
Global API config remains required
Without a global API key and without api.enabled: true in ~/.polycrate/polycrate.yml, coupling stays off — regardless of the workspace field.