Workspace settings

Everything an admin sets on the Workspace settings page is one document: a mapping of top-level keys, the same layout as the settings.yaml file wmill sync keeps. Only a workspace admin can read or change it.

Applying a document

• A partial document changes only the keys it states; every key it omits is left as it is.
• Each key is replaced whole, so read its current value and send it back edited: a nested object given with one field replaces the stored object with that one field.
• A key set to null clears that setting; an on/off switch cleared this way reads as false.
• Each setting is written through the same path the settings page uses, with the same validation and audit log. The writes are not one transaction: when one fails the apply stops, and the error says what was already written.
• A dry run reports the changes, as before / after per key, without writing anything.
• name is never applied: rename a workspace on the settings page. color is applied only when set to a value, so null does not clear it.
• A key the server does not know is ignored and named in the warnings: check them, since a typo otherwise reads as "nothing to change".
• A setting this edition does not offer (Enterprise only) is refused, by the dry run too.

Secrets

slack_oauth_client_secret is the one secret. A read shows __SENSITIVE_AND_UNCHANGED__ in place of a set secret; sending that placeholder back keeps the stored value. A value starting with $encrypted: is decrypted with the workspace key, and one encrypted with another workspace's key is left unchanged with a warning; any other value is taken as plaintext. Never write a secret you were not given: keep the placeholder.

Keys