Access

Overview

Dome separates platform administration from runtime agent access. A workspace role or platform API key governs CLI commands, API endpoints, and MCP management tools. Rules govern what a registered agent may do at the gateway. Refer to Permissions concept for the two-layer model. Memberships attach people to a workspace with one role. Platform API keys attach automation to a workspace, tenant, or org scope with an explicit permission list. Agent API keys authenticate agent runtimes and use a separate lifecycle. Refer to create an agent API key for agent credentials. The typical workflow is:

Assign a workspace member a role that matches their job.
Create a platform API key for CI/CD or user automation that must call the Dome API.
Revoke keys and remove memberships when access is no longer needed.

Apply least privilege to memberships and platform API keys. The sections below explain the roles you can assign and how platform API keys are scoped.

Workspace roles

Assign one role per member in each workspace. Roles apply per workspace. The same user can hold different roles across workspaces.

Role	Access
`admin`	Full workspace management.
`operator`	Agent and gateway operations.
`security`	Authorization rules and audit.
`viewer`	Read-only access.

You set the role when you assign a workspace member.

Platform API keys

Platform API keys authenticate automation against the Dome API. Scope a key to workspace, tenant, or org. Set expiration for temporary automation and revoke unused keys immediately. Agent credentials use a separate lifecycle. For agent authentication, create an agent API key. You create, list, and revoke keys when you manage platform API keys.

Requirements

Before you begin, authenticate the Dome CLI and select a workspace context.

Permissions

Member and platform API key management require elevated roles. Each operation states the permission it requires. For exhaustive flags, tool parameters, and endpoint contracts, refer to the CLI, MCP, and API references.

Default roles	Permission	Grants
Workspace `admin` (or equivalent cascade)	Workspace admin membership	Assign and remove workspace members and roles
`admin`, `operator` (at the target scope)	`apikey.manage`	Create, list, and revoke platform API keys

Manage workspace members

Assign one role per member in each workspace. Choose from the workspace roles above.

Requires workspace admin (or an equivalent cascaded role).

CLI
MCP
API
Agent

dome workspace members list
dome workspace members set --user user@example.com --role operator
dome workspace members remove --user user@example.com --revoke-all-keys

Flag	Applies to	Description
`--user`	set, remove	User email address.
`--role`	set	`admin`, `operator`, `security`, or `viewer`.
`--revoke-keys`	remove	API key IDs to revoke during removal.
`--revoke-all-keys`	remove	Revokes every API key created by the user.

Reference: dome workspace members

Tools: dome_workspace_members_list, dome_workspace_members_set, dome_workspace_members_remove

Reference: dome_workspace_members_set

RPCs: ListWorkspaceMemberships, SetWorkspaceMembership, RemoveWorkspaceMembership

POST /dome.mgmt.v1.Management/SetWorkspaceMembership
Content-Type: application/json

{
  "tenant_id": "{{TENANT_ID}}",
  "workspace_id": "{{WORKSPACE_ID}}",
  "user_email": "user@example.com",
  "role": "operator"
}

Reference: SetWorkspaceMembership

Assign a workspace role

Set member "user@example.com" to the operator role.

Manage platform API keys

Create scoped keys for CI/CD pipelines and user automation. Agent credentials use a separate lifecycle.

Requires apikey.manage at the scope where you create the key.

CLI
MCP
API
Agent

dome platform-keys list
dome platform-keys create \
  --name "ci-deploy" \
  --permissions rules.deploy,agent.register \
  --expires-at 2026-12-31T00:00:00Z
dome platform-keys revoke ci-deploy

Reference: dome platform-keys

Tools: dome_platform_keys_list, dome_platform_keys_create, dome_platform_keys_revoke

Reference: dome_platform_keys_create

RPCs: ListAPIKeys, CreateAPIKey, RevokeAPIKey

POST /dome.mgmt.v1.Management/CreateAPIKey
Content-Type: application/json

{
  "name": "ci-deploy",
  "permissions": ["rules.deploy", "agent.register"],
  "expires_at": "2026-12-31T00:00:00Z",
  "scope_kind": "workspace",
  "scope_id": "{{WORKSPACE_ID}}"
}

Reference: CreateAPIKey

Create a platform API key

Create a platform API key named "ci-deploy" with permissions rules.deploy and agent.register.

Scope keys to workspace, tenant, or org. Set expiration for temporary automation and revoke unused keys immediately. For agent authentication, create an agent API key.

Get started

Core concepts

Connect

Govern

Operate

Manage

Develop

Reference

Overview

Workspace roles

Platform API keys

Requirements

Permissions

Manage workspace members

Manage platform API keys

Next steps

​Overview

​Workspace roles

​Platform API keys

​Requirements

​Permissions

​Manage workspace members

​Manage platform API keys

​Next steps

Overview

Workspace roles

Platform API keys

Requirements

Permissions

Manage workspace members

Manage platform API keys

Next steps