Step 3 — Workspace and profile
One container, one profile per advertised business — and why the distinction decides what every later call means.
A workspace is the container: billing, members, branding, API keys. A profile is one advertised business inside it — one set of ad accounts, one CRM, one tracker, one attribution answer.
Most businesses need one workspace and one profile. An agency needs one workspace and a profile per client.
Every later step is per profile
Connections, the tracker, conversion definitions, attribution windows, the Meta destination, readiness — all of it belongs to a profile, not to the workspace. Creating the second profile means doing steps 5 to 12 again for it.
Create the workspace
On your first sign-in you are asked for a workspace name — your company, or your agency. One is usually enough.
Create the profile
Then a profile: the business you are actually going to measure. Give it the brand's name, and set its reporting currency — every money figure on the profile is rendered in it.
Add more later
Profiles → New profile for the next client. A profile that would exceed your plan's active-profile allowance is refused with a clear message rather than created and quietly disabled.
curl -sX POST https://api.atribu.app/api/v1/workspaces \
-H "Authorization: Bearer atb_user_…" \
-H "Content-Type: application/json" \
-d '{"name": "Acme", "timezone": "America/Santiago", "plan": "starter"}'Since #1085 the atb_user_… token you got in step 2 is accepted here directly,
and the call is idempotent on (you, name) for a short window — a retry
after a dropped connection returns the same workspace with created: false
rather than a duplicate. plan defaults to starter (Free); growth and
agency write a trialing subscription at that plan's real limits
immediately, so an agent that asked for Growth is not silently left on Free.
curl -sX POST https://api.atribu.app/api/v1/profiles \
-H "Authorization: Bearer atb_user_…" \
-H "Content-Type: application/json" \
-d '{"workspace_id": "…", "name": "Acme Chile", "currency": "CLP"}'Then read back what you can reach — this is the call to make first on every run, because a user token may span several workspaces:
curl -H "Authorization: Bearer atb_user_…" \
https://api.atribu.app/api/v1/workspacesOver MCP the equivalents are whoami, list_workspaces and list_profiles.
whoami costs zero units and answers with the workspaces, profiles, currency,
PII mode and write-back state the caller actually has — call it first, always,
rather than guessing.
Over MCP
create_workspace and create_profile are these two calls as tools (#1058),
each with a free mode: "preview" before mode: "confirm". An MCP-only agent
needs no REST call and no browser for this step.
A user token must name a profile
An API key is one profile, so profile-scoped routes need no parameter. An
atb_user_… token may reach several, so ?profile_id=<uuid> is required on
those routes — its absence is a 400, never a guess.
Plan limits
active_profiles is the one plan limit enforced on every profile-creation path.
Read it before planning a batch:
curl -H "Authorization: Bearer …" \
https://api.atribu.app/api/v1/workspaces/{workspaceId}/subscriptionplan_limit_reached on a create is the answer to upgrade first, and
step 12 is where that happens.