> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# dome workspace

> Manage workspaces, members, act-as enforcement, policy freshness, and verification providers

## Workspace Lifecycle

### List

`dome workspace list`

List workspaces in the active tenant. Aliases: `ls`.

### Create

`dome workspace create`

Create a new workspace.

| Flag     | Type   | Required | Description            |
| -------- | ------ | -------- | ---------------------- |
| `--name` | string | Yes      | Workspace display name |

### Get

`dome workspace get <id-or-slug>`

Get workspace details. The output includes the configured `Freshness Window` — how long the gateway may serve cached policy for the workspace before failing closed.

### Delete

`dome workspace delete <id-or-slug>`

Delete a workspace permanently.

## Members

### Members list

`dome workspace members list [workspace-id-or-slug]`

List workspace memberships.

### Members set

`dome workspace members set [workspace-id-or-slug]`

Set a user's role in a workspace.

| Flag     | Type   | Required | Description                                     |
| -------- | ------ | -------- | ----------------------------------------------- |
| `--user` | string | Yes      | User email                                      |
| `--role` | string | Yes      | Role: `admin`, `operator`, `security`, `viewer` |

### Members remove

`dome workspace members remove [workspace-id-or-slug]`

Remove a user's workspace membership. If the user has active API keys, an interactive picker prompts you to select which to revoke; pass `--revoke-all-keys` or `--revoke-keys` to skip the prompt.

| Flag                | Type      | Required | Description                                                                                                    |
| ------------------- | --------- | -------- | -------------------------------------------------------------------------------------------------------------- |
| `--user`            | string    | Yes      | User email                                                                                                     |
| `--revoke-keys`     | string\[] | No       | Comma-separated API key IDs to revoke (skips interactive prompt). Mutually exclusive with `--revoke-all-keys`. |
| `--revoke-all-keys` | bool      | No       | Revoke all API keys created by the user (skips interactive prompt). Mutually exclusive with `--revoke-keys`.   |

## Act-As Enforcement

### Actas get

`dome workspace actas get [workspace-id-or-slug]`

Get the act-as enforcement policy.

### Actas update

`dome workspace actas update [workspace-id-or-slug]`

Update the act-as enforcement policy.

| Flag                | Type      | Description                                         |
| ------------------- | --------- | --------------------------------------------------- |
| `--required`        | bool      | Require act-as header on all requests               |
| `--allowed-methods` | string\[] | Allowed verification methods (e.g., `oidc`, `hmac`) |

## Policy Freshness Window

Each workspace has a configurable freshness window that bounds how long the gateway may serve cached authorization policy for that workspace before failing closed. Default is 90 seconds; allowed range is 30–86400 seconds. Enforcement is per-workspace — one workspace failing closed does not affect others.

### `dome workspace set-freshness-window <seconds> [workspace-id-or-slug]`

Set the freshness window (in seconds) for a workspace.

| Argument                 | Type   | Required | Description                                         |
| ------------------------ | ------ | -------- | --------------------------------------------------- |
| `<seconds>`              | uint   | Yes      | Freshness window in seconds (30–86400)              |
| `[workspace-id-or-slug]` | string | No       | Target workspace (defaults to the active workspace) |

<Warning>
  Once the window elapses, the gateway returns `access_denied` for every request in that workspace and emits a `authorization.staleness_rejected` audit event until the workspace's policy is fresh again.
</Warning>

## Verification Providers

### Verification-providers list

`dome workspace verification-providers list [workspace-id-or-slug]`

List verification providers.

### Verification-providers create

`dome workspace verification-providers create [workspace-id-or-slug]`

Create a verification provider.

| Flag                   | Type   | Required    | Description                                     |
| ---------------------- | ------ | ----------- | ----------------------------------------------- |
| `--name`               | string | Yes         | Provider name                                   |
| `--method`             | string | Yes         | Verification method: `oidc` or `hmac`           |
| `--oidc-discovery-url` | string | Conditional | OIDC issuer discovery URL (required for `oidc`) |
| `--hmac-secret`        | string | Conditional | HMAC shared secret (required for `hmac`)        |

### Verification-providers delete

`dome workspace verification-providers delete <provider-id> [workspace-id-or-slug]`

Delete a verification provider.