# Workspace Settings

MUST use when reading or changing workspace settings, or the settings.yaml file `wmill...

- Repository: https://github.com/windmill-labs/windmill (18352 stars)
- Category: Engineering
- License: see repository
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add windmill-labs/windmill --skill workspace-settings -g -a claude-code -y`
Codex: `npx skills add windmill-labs/windmill --skill workspace-settings -g -a codex -y`
Cursor: `npx skills add windmill-labs/windmill --skill workspace-settings -g -a cursor -y`
Gemini CLI: `npx skills add windmill-labs/windmill --skill workspace-settings -g -a gemini-cli -y`

## Description

MUST use when reading or changing workspace settings, or the settings.yaml file `wmill sync` keeps.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Workspace settings

Everything an admin sets on the Workspace settings page is one document: a mapping of top-level
keys, the same layout as the `settings.yaml` file `wmill sync` keeps. Only a workspace admin can
read or change it.

## Applying a document

- A partial document changes only the keys it states; every key it omits is left as it is.
- Each key is replaced whole, so read its current value and send it back edited: a nested object
  given with one field replaces the stored object with that one field.
- A key set to `null` clears that setting; an on/off switch cleared this way reads as `false`.
- Each setting is written through the same path the settings page uses, with the same validation
  and audit log. The writes are not one transaction: when one fails the apply stops, and the
  error says what was already written.
- A dry run reports the changes, as `before` / `after` per key, without writing anything.
- `name` is never applied: rename a workspace on the settings page. `color` is applied only when
  set to a value, so `null` does not clear it.
- A key the server does not know is ignored and named in the warnings: check them, since a typo
  otherwise reads as "nothing to change".
- A setting this edition does not offer (Enterprise only) is refused, by the dry run too.

## Secrets

`slack_oauth_client_secret` is the one secret. A read shows `__SENSITIVE_AND_UNCHANGED__` in place
of a set secret; sending that placeholder back keeps the stored value. A value starting with
`$encrypted:` is decrypted with the workspace key, and one encrypted with another workspace's key
is left unchanged with a warning; any other value is taken as plaintext. Never
write a secret you were not given: keep the placeholder.

## Keys

The rest: https://github.com/windmill-labs/windmill/blob/HEAD/system_prompts/auto-generated/skills/workspace-settings/SKILL.md