ts workspace

Show and manage one workspace: its settings, who holds which role in it, and its lifecycle.

Usage

ts workspaces [--csv] [--no-trunc]
ts workspace <workspace>
ts workspace new <name>
ts workspace set <workspace> <property> <value>
ts workspace delete <workspace> [--force]
ts workspace restore <workspace>
ts workspace permissions <workspace>
ts workspace grant <workspace> <user-or-group> <level> [--group]
ts workspace change-role <workspace> <user-or-group> <level> [--group]
ts workspace revoke <workspace> <user-or-group> [--group]

Description

ts workspaces lists workspaces with their ID, name, and when each was created and last updated. Every singular form takes the workspace as its ID (the short name in URLs, such as acme) or its GUID.

With no action, ts workspace <ws> prints a summary — ID, name, GUID, timestamps, and how many apps and channels it holds.

Actions:

• new <name> creates a workspace and reports the ID the server assigned. It takes a Server Administrator.
• set <ws> <property> <value> changes one setting. Settable properties are name, default-domain, documentation, chat-enabled, default-item-visibility, and logo-width; any other is refused. The value is typed from the setting's current value, and the setting is read back after the write.
• delete <ws> removes it. This is a soft delete: the workspace stops appearing, and restore brings it back. Deleting also discards the saved sessions of the workspace's sandboxes, data included, and restore does not bring those back. It prompts first unless you pass --force, and where there is no terminal --force is required.
• restore <ws> undoes a delete. It is refused when another workspace has taken the deleted one's ID since. delete and restore take a Server Administrator.
• permissions <ws> prints who holds a role in the workspace, as the server's JSON list.
• grant <ws> <user-or-group> <level> gives an account or a group a role, change-role changes the role it holds, and revoke takes it away. These take an administrator of the workspace.

Roles

The levels are user, analyst, and administrator; read-only-admin is accepted as another name for analyst. A user is a member of the workspace. An analyst also reads every member's sandboxes and shared conversations, and changes nothing. An administrator changes the workspace's settings, members, and contents. An account holds every role granted to it directly or through a group.

Name an account by its login name or ID, and a group, with --group, by its name or ID. Where two identity sources hold a group's name, put the source's login prefix and a backslash before it (CORP\Sales). A deleted account or group keeps its permissions until they are revoked: name it by its ID, the userGuid that permissions prints.

A grantee that already holds a role is refused; use change-role instead. A change or revocation that would leave the workspace with no administrator is refused, so grant the role to someone else first. A personal workspace belongs to its owner: it has no other members, only a Server Administrator can add another administrator to it, and its owner's role can be neither changed nor revoked. Creating, deleting, and restoring a workspace, and every grant, change, and revocation, are recorded in the audit trail.

Options

Flag	Description	Default/Values	Notes
--force, -f	Delete without confirming.		Required when there is no terminal.
--group	The user-or-group is a group.		grant, change-role, and revoke. Without it the name is an account.
--csv	Tab-separated output, nothing truncated.		ts workspaces only.
--no-trunc	Do not truncate columns.		ts workspaces only.

Examples

# Every workspace, then one in summary
ts workspaces
ts workspace acme

# Create one and give someone administration of it
ts workspace new acme
ts workspace grant acme alice administrator

# Give a group membership, then let it read members' sandboxes
ts workspace grant acme Engineering user --group
ts workspace change-role acme Engineering analyst --group

# Change a setting
ts workspace set acme documentation "Internal design tools"
ts workspace set acme chat-enabled true

# Who holds which role
ts workspace permissions acme

# Remove access
ts workspace revoke acme alice

# Retire it, then change your mind
ts workspace delete acme
ts workspace restore acme

# In a script, where there is no one to confirm
ts workspace delete acme --force

# Without --group the name is looked up as an account, so this fails
# for a group called Engineering. Add --group.
ts workspace revoke acme Engineering

Output

ID:       acme
Name:     Acme Design
Guid:     9b336df2-2599-490b-99bc-e17f2bf50f66
Created:  2026-07-29T23:26:48.192Z
Updated:  2026-07-29T23:27:02.551Z
Apps:     12
Channels: 3

permissions emits JSON, so it pipes into jq. Each entry carries the grantee's userName and userGuid, its userType (0 an account, 1 a group), and its role.

Exit Codes

0 on success. -6 when the workspace does not exist, and when change-role or revoke names a grantee with no role in the workspace. -5 when the account does not administer the workspace, or when new, delete, or restore is run without Server Administrator rights. -1 when a property is not settable, a level is unknown, a confirmation is declined, or the server refuses the change: a grantee that already holds a role, the last administrator, a personal workspace's membership, or a restore whose ID is taken.

Related Commands

• ts app — The apps placed in a workspace.
• ts channel — The channels that sort a workspace's apps and links.
• ts group — The groups a role is granted to.
• ts policy — What those workspaces' apps are allowed to launch.