Workspace settings

Everything an admin sets on the Workspace settings page is one document: a mapping of top-level keys, the same layout as the settings.yaml file wmill sync keeps. Only a workspace admin can read or change it.

Applying a document

• A partial document changes only the keys it states; every key it omits is left as it is.
• Each key is replaced whole, so read its current value and send it back edited: a nested object given with one field replaces the stored object with that one field.
• A key set to null clears that setting; an on/off switch cleared this way reads as false.
• Each setting is written through the same path the settings page uses, with the same validation and audit log. The writes are not one transaction: when one fails the apply stops, and the error says what was already written.
• A dry run reports the changes, as before / after per key, without writing anything.
• name is never applied: rename a workspace on the settings page. color is applied only when set to a value, so null does not clear it.
• A key the server does not know is ignored and named in the warnings: check them, since a typo otherwise reads as "nothing to change".
• A setting this edition does not offer (Enterprise only) is refused, by the dry run too.

Secrets

slack_oauth_client_secret is the one secret. A read shows __SENSITIVE_AND_UNCHANGED__ in place of a set secret; sending that placeholder back keeps the stored value. A value starting with $encrypted: is decrypted with the workspace key, and one encrypted with another workspace's key is left unchanged with a warning; any other value is taken as plaintext. Never write a secret you were not given: keep the placeholder.

Keys

From the command line

wmill workspace get-settings prints the document (--encrypted for secrets encrypted with the workspace key, --json for JSON). wmill workspace apply-settings <file> applies a partial document from a YAML or JSON file: it shows the changes and asks before writing (--dry-run to only show them, -y to skip the question, --replace to clear what the file omits).

In a synced repository

With includeSettings: true in wmill.yaml, wmill sync pull writes the document to settings.yaml, secrets encrypted with the workspace key (plaintext only with plainSecrets), and wmill sync push applies it. Unlike a partial apply, a push treats the file as the whole document: a setting the file omits is cleared, except operator_settings, color, the auto-invite instance groups, and the keys ducklake, dbt_warehouses, deploy_ui, teams_command_script, public_app_execution_limit_per_minute, guest_access_enabled, guest_jwt_public_key, guest_jwt_jwks_url, error_handler_fallback_to_instance_alerts and add_admins_and_developers_to_forks, which are managed only when the file states them. datatable_permissions is pushed only with includeDatatablePermissions: true (or --include-datatable-permissions). A push ignores protection_rules: protection-rules.yaml and wmill protection-rules push sync them.